hxxps://filedm[.]com/s9C5b

Analysis

max time kernel
396s
max time network
402s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 14:51 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://filedm.com/s9C5b

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 9 IoCs

pid	Process
1388	Synapse X Free - UWP 2.598_94351.exe
2752	Synapse X Free - UWP 2.598_94351.exe
592	setup94351.exe
1648	setup94351.exe
6032	setup94351.exe
5256	OfferInstaller.exe
5524	setup94351.exe
5592	Synapse X Free - UWP 2.598_94351.exe
5744	setup94351.exe

Loads dropped DLL 64 IoCs

pid	Process
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6084	4748	WerFault.exe	154

Delays execution with timeout.exe 5 IoCs

evasion

pid	Process
5472	timeout.exe
5712	timeout.exe
5784	timeout.exe
2000	timeout.exe
3904	timeout.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

Process Discovery

T1057

pid	Process
5332	tasklist.exe
5680	tasklist.exe
5732	tasklist.exe
5828	tasklist.exe
1240	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Synapse X Beta Release.exe = "11001"	Synapse X Beta Release.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	Synapse X Free - UWP 2.598_94351.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Local Settings	msedge.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd942000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	setup94351.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0400000001000000100000004be2c99196650cf40e5a9392a00afeb20f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4190000000100000010000000fa46ce7cbb85cfb4310075313a09ee052000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	setup94351.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 5c000000010000000400000000080000190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd940400000001000000100000004be2c99196650cf40e5a9392a00afeb22000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	setup94351.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	setup94351.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	setup94351.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	setup94351.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	setup94351.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d42000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	setup94351.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 570464.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5976	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
4460	msedge.exe
4460	msedge.exe
3468	identity_helper.exe
3468	identity_helper.exe
3512	msedge.exe
3512	msedge.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
1648	setup94351.exe
592	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe
592	setup94351.exe
1648	setup94351.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	setup94351.exe
Token: SeDebugPrivilege	1648	setup94351.exe
Token: SeDebugPrivilege	5256	OfferInstaller.exe
Token: SeDebugPrivilege	5332	tasklist.exe
Token: SeDebugPrivilege	5680	tasklist.exe
Token: SeDebugPrivilege	5732	tasklist.exe
Token: SeDebugPrivilege	5828	tasklist.exe
Token: SeDebugPrivilege	5744	setup94351.exe
Token: SeDebugPrivilege	1240	tasklist.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe
4460	msedge.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
1388	Synapse X Free - UWP 2.598_94351.exe
2752	Synapse X Free - UWP 2.598_94351.exe
2752	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
2752	Synapse X Free - UWP 2.598_94351.exe
1388	Synapse X Free - UWP 2.598_94351.exe
592	setup94351.exe
1648	setup94351.exe
5592	Synapse X Free - UWP 2.598_94351.exe
5592	Synapse X Free - UWP 2.598_94351.exe
5744	setup94351.exe
5592	Synapse X Free - UWP 2.598_94351.exe
1648	setup94351.exe
4748	Synapse X Beta Release.exe
4748	Synapse X Beta Release.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 4416	4460	msedge.exe	33
PID 4460 wrote to memory of 4416	4460	msedge.exe	33
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 4312	4460	msedge.exe	83
PID 4460 wrote to memory of 220	4460	msedge.exe	82
PID 4460 wrote to memory of 220	4460	msedge.exe	82
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84
PID 4460 wrote to memory of 2792	4460	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filedm.com/s9C5b
1⤵
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba10746f8,0x7ffba1074708,0x7ffba1074718
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2488 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe
  "C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1388
- - C:\Users\Admin\AppData\Local\setup94351.exe
    C:\Users\Admin\AppData\Local\setup94351.exe hhwnd=720980 hreturntoinstaller hextras=id:--
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1648
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
      4⤵
      PID:3956
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "1648"
        5⤵
        
        PID:3932
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 1648" /fo csv
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1240
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:3904
- - C:\Users\Admin\AppData\Local\setup94351.exe
    C:\Users\Admin\AppData\Local\setup94351.exe hready
    3⤵
    - Executes dropped EXE
    PID:6032
- C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe
  "C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2752
- - C:\Users\Admin\AppData\Local\setup94351.exe
    C:\Users\Admin\AppData\Local\setup94351.exe hhwnd=721388 hreturntoinstaller hextras=id:--
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:592
  - - C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe
      "C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\OfferInstaller.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5256
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
        5⤵
        
        PID:5648
      - C:\Windows\SysWOW64\find.exe
        
        find /I "5256"
        6⤵
        
        PID:5700
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 5256" /fo csv
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5680
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:5712
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 5256" /fo csv
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5732
      - C:\Windows\SysWOW64\find.exe
        
        find /I "5256"
        6⤵
        
        PID:5692
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        Delays execution with timeout.exe
        
        PID:5784
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 5256" /fo csv
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5828
      - C:\Windows\SysWOW64\find.exe
        
        find /I "5256"
        6⤵
        
        PID:4476
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        6⤵
        Delays execution with timeout.exe
        
        PID:2000
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\H2OCleanup.bat""
      4⤵
      PID:5192
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /FI "PID eq 592" /fo csv
        5⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5332
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "592"
        5⤵
        
        PID:5344
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 5
        5⤵
        Delays execution with timeout.exe
        
        PID:5472
- - C:\Users\Admin\AppData\Local\setup94351.exe
    C:\Users\Admin\AppData\Local\setup94351.exe hready
    3⤵
    - Executes dropped EXE
    PID:5524
- - C:\Windows\SysWOW64\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\link.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:5184
- C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe
  "C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5592
- - C:\Users\Admin\AppData\Local\setup94351.exe
    C:\Users\Admin\AppData\Local\setup94351.exe hhwnd=262792 hreturntoinstaller hextras=id:--
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,1505931127986695002,1719562606136006796,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5740 /prefetch:2
  2⤵
  PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4264

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5632

C:\Users\Admin\Desktop\Synapse X UWP - v2.598\Synapse X Beta Release.exe
"C:\Users\Admin\Desktop\Synapse X UWP - v2.598\Synapse X Beta Release.exe"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4748
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4748 -s 2356
  2⤵
  - Program crash
  PID:6084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4748 -ip 4748
1⤵
PID:2096

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:5356

Network

DNS

158.240.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

158.240.127.40.in-addr.arpa

IN PTR

Response
DNS

filedm.com

Synapse X Free - UWP 2.598_94351.exe

Remote address:

8.8.8.8:53

Request

filedm.com

IN A

Response

filedm.com

IN A

188.114.97.0

filedm.com

IN A

188.114.96.0
GET

https://filedm.com/s9C5b

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /s9C5b HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: text/html; charset=UTF-8
set-cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
via: 1.1 google
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t%2BL1Vw5mcWPkwqvCvYSlNsP5PvzWQaB5uPZSLBiNN7K45aK80HFtxUBIyzJgaVeLMbAsgNErEwNjjH8jahmUQ3cLPq5UqTZzQNk%2BWoqRFCbcTCBjTHSQWmLP5hpf"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7f82bd186b320e94-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/libs/@fortawesome/fontawesome-free/css/all.min.css

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/libs/@fortawesome/fontawesome-free/css/all.min.css HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: text/css
via: 1.1 google
age: 449
last-modified: Fri, 10 Jul 2020 13:21:11 GMT
etag: W/"5f086b47-de0a"
cache-control: public, max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2rG5N7uOHfk2k88PYtb7UPMIlI7PvUy29Ale%2Bg5WRvUuE1auQhbNUdvcttGhxgo7VCJlcQ2k7QNHFPxjfkMIaDtxp%2FWNHibvGhrniHntLZPkTjJt5xUJWhxyIpsE"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd194c550e94-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/css/quick-website.css

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/css/quick-website.css HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: text/css
via: 1.1 google
age: 449
last-modified: Fri, 10 Jul 2020 13:20:49 GMT
etag: W/"5f086b31-6f11b"
cache-control: public, max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lDx7Og6nIEV3qityWyX50Bq7XIBdNpql8wUWx5amvpcTKO7hgzWN%2Fvy5xamK6b9KbXfZmqaHz%2FW%2Bg9MU7GrJL9Ngj7dftf3RIHYUFizsSxivNOf5zy8L6KFKjMnL"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd194c580e94-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/libs/jquery/dist/jquery.min.js

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/libs/jquery/dist/jquery.min.js HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: application/javascript
via: 1.1 google
last-modified: Fri, 10 Jul 2020 13:21:03 GMT
etag: W/"5f086b3f-15851"
age: 449
cache-control: public, max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Py0fTVzV17gL9N5ilsj3u3191pur%2Bs35kxJt2MU4%2BmjJELzBJMva1rpQiMIJCG9P8rtLiKgS16miZccniERNS0GrxniEI4sBEv0JHNfrIv1YD5Icwrb4%2FOYI0Oug"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd19dd160e94-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/libs/bootstrap/dist/js/bootstrap.bundle.min.js

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/libs/bootstrap/dist/js/bootstrap.bundle.min.js HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: application/javascript
via: 1.1 google
age: 449
last-modified: Fri, 10 Jul 2020 13:21:17 GMT
etag: W/"5f086b4d-13b3a"
cache-control: public, max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lGUj5jOKxUBVSOyEhtR5hxwdVlCsGyuOzHZWwkXzu9vMfOYBIA2cn%2FZM9DxekJ9TZKG4x7UY9KgmzzZZT4SIdVa6KYeb1qlZssq%2FZr%2F6kthE%2FuJtBQzheJvwC%2FsM"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd19dd190e94-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/libs/svg-injector/dist/svg-injector.min.js

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/libs/svg-injector/dist/svg-injector.min.js HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: application/javascript
via: 1.1 google
age: 449
last-modified: Fri, 10 Jul 2020 13:21:08 GMT
etag: W/"5f086b44-11e3"
cache-control: public, max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dBMEU9wcRjgs%2ByeiXHPMQ%2Ff%2FObHM0bLQNeOGtdFanC8pKJivnmZAhNnwjpXwdtvDEXCpcfozGE5jv8f7B%2B4fXX0LgdtHapwtMWO16Cp29bAmkHw6YFwzZX7feY9S"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd1a4dc50e94-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/libs/feather-icons/dist/feather.min.js

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/libs/feather-icons/dist/feather.min.js HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: application/javascript
via: 1.1 google
age: 449
last-modified: Fri, 10 Jul 2020 13:20:59 GMT
etag: W/"5f086b3b-11b29"
cache-control: public, max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6wGJ0YW6gKnYxOQPXldzIDbb8sYMLZbNMXosNziVolKZr5lXQn7tolBdCBjYUvXdeVMN1TTiigBCTLm0%2BU6K79gJD%2BZqJWbFf2knfU3pQkPny8FbOUZr2RBETKOD"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd1abe8a0e94-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/js/quick-website.js

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/js/quick-website.js HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: image/png
content-length: 12224
via: 1.1 google
age: 449
last-modified: Fri, 04 Aug 2023 11:15:28 GMT
etag: "64ccddd0-2fc0"
cache-control: public, max-age=14400
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=78YkdfGZGcA8%2Fs2PBY44sipUKIh1oVsZdagyzC1QRViPcMQA60YO09nACevh9WTWHYZn4HC1kxTydLHUVVNigJ1D%2B2XGfzx%2BRkOupBVZIbVFzjdQRXJEvI1aDv8l"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd1aeeda0e94-AMS
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/img/brand/logo.png

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/img/brand/logo.png HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: image/png
content-length: 1346
via: 1.1 google
age: 449
last-modified: Fri, 10 Jul 2020 13:20:52 GMT
etag: "5f086b34-542"
cache-control: public, max-age=14400
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aED3DIEjQewQy8gsS%2B%2FrKeF1NCtj87iLy1HC2EUn8723dQ1x3hZpBQvVwG9%2BmDt5SK9bePtiAY%2BnTNHCXKnZ%2F1PAbFtVc8MljvJU29WX45pIW1oHOJttOHq9WLRg"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd1aeed70e94-AMS
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/img/brand/win.png

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/img/brand/win.png HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: image/png
content-length: 293
via: 1.1 google
age: 449
last-modified: Wed, 15 Jul 2020 15:04:45 GMT
etag: "5f0f1b0d-125"
cache-control: public, max-age=14400
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aeaSxa8I1IxrplNqK0qAz2H8%2Ftwxdby%2BEkm9JBaOU4xaOyPhKfFaoR03kHE%2BkNyXc%2FgnXWloavsgQkEqVZpzsFudH9%2F4Oui6ODbju9Wbo8rY0AObwmYZgkikL4R7"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd1aeed80e94-AMS
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/img/brand/marker_1.png

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/img/brand/marker_1.png HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: image/png
content-length: 434
via: 1.1 google
age: 449
last-modified: Wed, 15 Jul 2020 15:04:45 GMT
etag: "5f0f1b0d-1b2"
cache-control: public, max-age=14400
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6IxG%2BYLjibD6UxsCqO6G8aCsjm0Hv9IsKZmsKG8RP5J7wJSx3AdA8WQN01eV2N0wJK8uwCLPMHQT2Ay2CxR6Yr%2Ba6rotKeFZHAWjCmc0dNE7TAamMlCPgpWbaoKX"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd1aeed90e94-AMS
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/img/next.png

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/img/next.png HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-type: application/javascript
via: 1.1 google
age: 449
last-modified: Fri, 10 Jul 2020 13:20:49 GMT
etag: W/"5f086b31-16b8"
cache-control: public, max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u1z6XeF81mPmgVK447o%2FK8pA%2B8KdubccN0SHKoL3za2pdFEKQ%2Fm8sn2KGZaCXdzGpNIEGjmHLMXKttxcQaw%2B2d7DfqnAnkAfwBhsvu0sNYffJgYkEFXJfhkoNeo8"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd1aeed50e94-AMS
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/libs/@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/libs/@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2 HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: https://filedm.com
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: font
referer: https://filedm.com/assets/libs/@fortawesome/fontawesome-free/css/all.min.css
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:03 GMT
content-length: 75728
last-modified: Fri, 10 Jul 2020 13:21:13 GMT
etag: "127d0-5aa16370b6b60"
via: 1.1 google
cache-control: max-age=14400
cf-cache-status: HIT
age: 2124
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pSRAvPasEZ83vTao8L4vDowHOtA5St77Gg3OIc0jYyn%2FdLOAOlBMdXm%2BduRZvhW3IH%2BrH%2B578zYjDKc0oyGAqmIjksOIiomizMPRfSOKloOLLnbnfO6RA%2FXDbrHG"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd1cb9200e94-AMS
alt-svc: h3=":443"; ma=86400
GET

https://filedm.com/assets/img/brand/favicon.png

msedge.exe

Remote address:

188.114.97.0:443

Request

GET /assets/img/brand/favicon.png HTTP/2.0
host: filedm.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://filedm.com/s9C5b
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: PHPSESSID=dl77083oj2tv9u874sj48sfhi6
cookie: _ga_MY4YDH2LKP=GS1.1.1692283923.1.0.1692283923.0.0.0
cookie: _ga=GA1.1.2005362499.1692283923
cookie: __gads=ID=7b2f7c0aa1f38e63-22d20b1854de00ee:T=1692283924:RT=1692283924:S=ALNI_MaqkJREct_1-wiCgLuIoIdFajNR9A
cookie: __gpi=UID=00000c620b3e1b35:T=1692283924:RT=1692283924:S=ALNI_MZUlg9nhBDxFNiqgVC4rPs580pKyQ

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:07 GMT
content-type: image/png
content-length: 83827
via: 1.1 google
age: 453
last-modified: Fri, 10 Jul 2020 13:20:52 GMT
etag: "5f086b34-14773"
cache-control: public, max-age=14400
cf-cache-status: HIT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=axGhePg8Y%2FLC9CgY7DfMttkEB3UaqZVtv4fNwSEcgheNbSWKZkb2zwOdXZIMEulspNP5Sai2RDQUjCe7wWCZKmFbjLmMbyaBbPRl2TQ4dU91G1wYfWnUg%2FGYtUnz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 7f82bd3099220e94-AMS
alt-svc: h3=":443"; ma=86400
DNS

apps.identrust.com

msedge.exe

Remote address:

8.8.8.8:53

Request

apps.identrust.com

IN A

Response

apps.identrust.com

IN CNAME

identrust.edgesuite.net

identrust.edgesuite.net

IN CNAME

a1952.dscq.akamai.net

a1952.dscq.akamai.net

IN A

88.221.25.153

a1952.dscq.akamai.net

IN A

88.221.25.169
GET

http://apps.identrust.com/roots/dstrootcax3.p7c

msedge.exe

Remote address:

88.221.25.153:80

Request

GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: apps.identrust.com

Response

HTTP/1.1 200 OK

X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=15768000
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' *.identrust.com
Last-Modified: Wed, 08 Feb 2023 16:52:56 GMT
ETag: "37d-5f433188daa00"
Accept-Ranges: bytes
Content-Length: 893
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Type: application/pkcs7-mime
Cache-Control: max-age=3600
Expires: Thu, 17 Aug 2023 15:52:03 GMT
Date: Thu, 17 Aug 2023 14:52:03 GMT
Connection: keep-alive
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

74.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

74.32.126.40.in-addr.arpa

IN PTR

Response
DNS

0.97.114.188.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.97.114.188.in-addr.arpa

IN PTR

Response
DNS

153.25.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

153.25.221.88.in-addr.arpa

IN PTR

Response

153.25.221.88.in-addr.arpa

IN PTR

a88-221-25-153deploystaticakamaitechnologiescom
DNS

108.211.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

108.211.229.192.in-addr.arpa

IN PTR

Response
DNS

googleads.g.doubleclick.net

msedge.exe

Remote address:

8.8.8.8:53

Request

googleads.g.doubleclick.net

IN A

Response

googleads.g.doubleclick.net

IN A

142.250.179.162
GET

https://googleads.g.doubleclick.net/pagead/html/r20230815/r20190131/zrt_lookup.html

msedge.exe

Remote address:

142.250.179.162:443

Request

GET /pagead/html/r20230815/r20190131/zrt_lookup.html HTTP/2.0
host: googleads.g.doubleclick.net
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://filedm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
OPTIONS

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x83a45f8a812f61710000000000000000%22,%222%22:%220x626a10b0306c7c020000000000000000%22,%225%22:%220x5a653054eef95e2c0000000000000000%22},%22debug_key%22:%222597011442594639183%22,%22debug_reporting%22:true,%22destination%22:%22https://grammarly.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22956476927%22],%224%22:[%2208-17%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211580217851216142337%22}&andc=true

msedge.exe

Remote address:

142.250.179.162:443

Request

OPTIONS /pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x83a45f8a812f61710000000000000000%22,%222%22:%220x626a10b0306c7c020000000000000000%22,%225%22:%220x5a653054eef95e2c0000000000000000%22},%22debug_key%22:%222597011442594639183%22,%22debug_reporting%22:true,%22destination%22:%22https://grammarly.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22956476927%22],%224%22:[%2208-17%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211580217851216142337%22}&andc=true HTTP/2.0
host: www.googleadservices.com
accept: */*
access-control-request-method: GET
access-control-request-headers: attribution-reporting-eligible
origin: https://googleads.g.doubleclick.net
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
sec-fetch-mode: cors
sec-fetch-site: cross-site
sec-fetch-dest: empty
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

106.208.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

106.208.58.216.in-addr.arpa

IN PTR

Response

106.208.58.216.in-addr.arpa

IN PTR

ams17s08-in-f101e100net

106.208.58.216.in-addr.arpa

IN PTR

sof01s11-in-f106�I
DNS

131.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

131.179.250.142.in-addr.arpa

IN PTR

Response

131.179.250.142.in-addr.arpa

IN PTR

ams17s10-in-f31e100net
DNS

200.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.179.250.142.in-addr.arpa

IN PTR

Response

200.179.250.142.in-addr.arpa

IN PTR

ams15s42-in-f81e100net
DNS

194.23.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

194.23.217.172.in-addr.arpa

IN PTR

Response

194.23.217.172.in-addr.arpa

IN PTR

ams16s37-in-f21e100net

194.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f194�H

194.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f2�H
DNS

partner.googleadservices.com

msedge.exe

Remote address:

8.8.8.8:53

Request

partner.googleadservices.com

IN A

Response

partner.googleadservices.com

IN CNAME

partner46.googleadservices.com

partner46.googleadservices.com

IN A

142.251.36.2
GET

https://partner.googleadservices.com/gampad/cookie.js?domain=filedm.com&callback=_gfp_s_&client=ca-pub-5249810785570428

msedge.exe

Remote address:

142.251.36.2:443

Request

GET /gampad/cookie.js?domain=filedm.com&callback=_gfp_s_&client=ca-pub-5249810785570428 HTTP/2.0
host: partner.googleadservices.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://filedm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

tpc.googlesyndication.com

msedge.exe

Remote address:

8.8.8.8:53

Request

tpc.googlesyndication.com

IN A

Response

tpc.googlesyndication.com

IN A

142.251.36.1
GET

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/qs_click_protection_fy2021.js

msedge.exe

Remote address:

142.251.36.1:443

Request

GET /pagead/js/r20230815/r20110914/client/qs_click_protection_fy2021.js HTTP/2.0
host: tpc.googlesyndication.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://tpc.googlesyndication.com/simgad/5812785455796822292/14763004658117789537?w=600&h=314

msedge.exe

Remote address:

142.251.36.1:443

Request

GET /simgad/5812785455796822292/14763004658117789537?w=600&h=314 HTTP/2.0
host: tpc.googlesyndication.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://tpc.googlesyndication.com/simgad/2984971332974739170?w=100&h=100

msedge.exe

Remote address:

142.251.36.1:443

Request

GET /simgad/2984971332974739170?w=100&h=100 HTTP/2.0
host: tpc.googlesyndication.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/load_preloaded_resource_fy2021.js

msedge.exe

Remote address:

142.251.36.1:443

Request

GET /pagead/js/r20230815/r20110914/client/load_preloaded_resource_fy2021.js HTTP/2.0
host: tpc.googlesyndication.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/abg_lite_fy2021.js

msedge.exe

Remote address:

142.251.36.1:443

Request

GET /pagead/js/r20230815/r20110914/abg_lite_fy2021.js HTTP/2.0
host: tpc.googlesyndication.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/window_focus_fy2021.js

msedge.exe

Remote address:

142.251.36.1:443

Request

GET /pagead/js/r20230815/r20110914/client/window_focus_fy2021.js HTTP/2.0
host: tpc.googlesyndication.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

www.googletagservices.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.googletagservices.com

IN A

Response

www.googletagservices.com

IN A

142.251.36.34
GET

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

msedge.exe

Remote address:

142.251.36.34:443

Request

GET /activeview/js/current/rx_lidar.js?cache=r20110914 HTTP/2.0
host: www.googletagservices.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

206.23.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.217.172.in-addr.arpa

IN PTR

Response

206.23.217.172.in-addr.arpa

IN PTR

ams16s37-in-f141e100net

206.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f14�I

206.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f206�I
DNS

162.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

162.179.250.142.in-addr.arpa

IN PTR

Response

162.179.250.142.in-addr.arpa

IN PTR

ams15s41-in-f21e100net
DNS

2.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.36.251.142.in-addr.arpa

IN PTR

Response

2.36.251.142.in-addr.arpa

IN PTR

ams15s44-in-f21e100net
DNS

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com

msedge.exe

Remote address:

8.8.8.8:53

Request

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com

IN A

Response

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com

IN A

172.217.23.195
GET

https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

msedge.exe

Remote address:

172.217.23.195:443

Request

GET /v6exp3/redir.html HTTP/2.0
host: p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://googleads.g.doubleclick.net/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

1.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.36.251.142.in-addr.arpa

IN PTR

Response

1.36.251.142.in-addr.arpa

IN PTR

ams15s44-in-f11e100net
DNS

34.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

34.36.251.142.in-addr.arpa

IN PTR

Response

34.36.251.142.in-addr.arpa

IN PTR

ams17s12-in-f21e100net
DNS

195.23.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.23.217.172.in-addr.arpa

IN PTR

Response

195.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f31e100net

195.23.217.172.in-addr.arpa

IN PTR

ams16s37-in-f3�H

195.23.217.172.in-addr.arpa

IN PTR

prg03s05-in-f195�H
DNS

x2.c.lencr.org

Remote address:

8.8.8.8:53

Request

x2.c.lencr.org

IN A

Response

x2.c.lencr.org

IN CNAME

crl.root-x1.letsencrypt.org.edgekey.net

crl.root-x1.letsencrypt.org.edgekey.net

IN CNAME

e8652.dscx.akamaiedge.net

e8652.dscx.akamaiedge.net

IN A

23.222.33.142
DNS

x2.c.lencr.org

Remote address:

8.8.8.8:53

Request

x2.c.lencr.org

IN A

Response

x2.c.lencr.org

IN CNAME

crl.root-x1.letsencrypt.org.edgekey.net

crl.root-x1.letsencrypt.org.edgekey.net

IN CNAME

e8652.dscx.akamaiedge.net

e8652.dscx.akamaiedge.net

IN A

23.222.33.142
DNS

196.168.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

196.168.217.172.in-addr.arpa

IN PTR

Response

196.168.217.172.in-addr.arpa

IN PTR

ams16s32-in-f41e100net
DNS

59.128.231.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

59.128.231.4.in-addr.arpa

IN PTR

Response
DNS

freefiledl.com

msedge.exe

Remote address:

8.8.8.8:53

Request

freefiledl.com

IN A

Response

freefiledl.com

IN A

104.21.68.145

freefiledl.com

IN A

172.67.196.44
GET

https://freefiledl.com/?id=Synapse%20X%20Free%20-%20UWP%202.598_94351

msedge.exe

Remote address:

104.21.68.145:443

Request

GET /?id=Synapse%20X%20Free%20-%20UWP%202.598_94351 HTTP/2.0
host: freefiledl.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
referer: https://filedm.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Thu, 17 Aug 2023 14:52:16 GMT
content-type: application/octet-stream
content-length: 9844640
x-powered-by: Express
cache-control: no-store
content-disposition: attachment; filename="Synapse X Free - UWP 2.598_94351.exe"
accept-ranges: bytes
last-modified: Thu, 17 Aug 2023 09:10:11 GMT
etag: W/"9637a0-18a02c270ce"
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fklfKW8FJezLOniIqiTTE3R59hEYONqFehjmyT9nYvdpXmrie8tGqjpxhp0Lzc0K4KsW48%2BpHOeKUAwsh0BQ4CCubowGcVLIwCBFwM9RjuVVIYxNbY2uppfYSl1jTN89Zg%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7f82bd689a410a75-AMS
alt-svc: h3=":443"; ma=86400
DNS

145.68.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.68.21.104.in-addr.arpa

IN PTR

Response
DNS

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i1-v6exp3.v4.metric.gstatic.com

msedge.exe

Remote address:

8.8.8.8:53

Request

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i1-v6exp3.v4.metric.gstatic.com

IN A

Response

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i1-v6exp3.v4.metric.gstatic.com

IN A

142.251.39.114
GET

https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i1-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif

msedge.exe

Remote address:

142.251.39.114:443

Request

GET /v6exp3/6.gif HTTP/2.0
host: p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i1-v6exp3.v4.metric.gstatic.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i2-v6exp3.ds.metric.gstatic.com

msedge.exe

Remote address:

8.8.8.8:53

Request

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i2-v6exp3.ds.metric.gstatic.com

IN A

Response

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i2-v6exp3.ds.metric.gstatic.com

IN A

142.250.179.146
GET

https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i2-v6exp3.ds.metric.gstatic.com/v6exp3/6.gif

msedge.exe

Remote address:

142.250.179.146:443

Request

GET /v6exp3/6.gif HTTP/2.0
host: p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i2-v6exp3.ds.metric.gstatic.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

114.39.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

114.39.251.142.in-addr.arpa

IN PTR

Response

114.39.251.142.in-addr.arpa

IN PTR

ams15s48-in-f181e100net
DNS

146.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

146.179.250.142.in-addr.arpa

IN PTR

Response

146.179.250.142.in-addr.arpa

IN PTR

ams17s10-in-f181e100net
DNS

38.148.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

38.148.119.40.in-addr.arpa

IN PTR

Response
DNS

101.14.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

101.14.18.104.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

101.15.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

101.15.18.104.in-addr.arpa

IN PTR

Response
DNS

www.dlsft.com

Synapse X Free - UWP 2.598_94351.exe

Remote address:

8.8.8.8:53

Request

www.dlsft.com

IN A

Response

www.dlsft.com

IN CNAME

dlsft.com

dlsft.com

IN A

35.190.60.70
DNS

www.dlsft.com

Synapse X Free - UWP 2.598_94351.exe

Remote address:

8.8.8.8:53

Request

www.dlsft.com

IN A

Response

www.dlsft.com

IN CNAME

dlsft.com

dlsft.com

IN A

35.190.60.70
DNS

26.165.165.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.165.165.52.in-addr.arpa

IN PTR

Response
DNS

70.60.190.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

70.60.190.35.in-addr.arpa

IN PTR

Response

70.60.190.35.in-addr.arpa

IN PTR

706019035bcgoogleusercontentcom
DNS

206.23.85.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

206.23.85.13.in-addr.arpa

IN PTR

Response
DNS

35.36.251.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.36.251.142.in-addr.arpa

IN PTR

Response

35.36.251.142.in-addr.arpa

IN PTR

ams17s12-in-f31e100net
DNS

dlsft.com

Synapse X Free - UWP 2.598_94351.exe

Remote address:

8.8.8.8:53

Request

dlsft.com

IN A

Response

dlsft.com

IN A

35.190.60.70
DNS

dlsft.com

Synapse X Free - UWP 2.598_94351.exe

Remote address:

8.8.8.8:53

Request

dlsft.com

IN A

Response

dlsft.com

IN A

35.190.60.70
GET

http://dlsft.com/callback/info.php?id=94351

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

GET /callback/info.php?id=94351 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:36 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 283
Vary: Accept-Encoding
Content-Encoding: gzip
Via: 1.1 google
GET

http://dlsft.com/callback/offers.php

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

GET /callback/offers.php HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:36 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 17
Via: 1.1 google
POST

http://dlsft.com/callback/geo/geo.php

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

POST /callback/geo/geo.php HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;charset=utf-8
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:36 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 18
Via: 1.1 google
POST

http://dlsft.com/callback/?channel=s9C5b&id=94351&action=started

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

POST /callback/?channel=s9C5b&id=94351&action=started HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;charset=utf-8
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:36 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Via: 1.1 google
POST

http://dlsft.com/callback/?channel=s9C5b&id=94351&action=completed

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

POST /callback/?channel=s9C5b&id=94351&action=completed HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;charset=utf-8
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:53:03 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Via: 1.1 google
DNS

filedm.com

Synapse X Free - UWP 2.598_94351.exe

Remote address:

8.8.8.8:53

Request

filedm.com

IN A

Response

filedm.com

IN A

188.114.96.0

filedm.com

IN A

188.114.97.0
DNS

filedm.com

Synapse X Free - UWP 2.598_94351.exe

Remote address:

8.8.8.8:53

Request

filedm.com

IN A

Response

filedm.com

IN A

188.114.96.0

filedm.com

IN A

188.114.97.0
POST

http://dlsft.com/callback/geo/geo.php

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

POST /callback/geo/geo.php HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;charset=utf-8
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:36 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 18
Via: 1.1 google
DNS

240.81.21.72.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.81.21.72.in-addr.arpa

IN PTR

Response
POST

http://dlsft.com/callback/?channel=s9C5b&id=94351&action=started

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

POST /callback/?channel=s9C5b&id=94351&action=started HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;charset=utf-8
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:36 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Via: 1.1 google
POST

http://dlsft.com/callback/?channel=s9C5b&id=94351&action=completed

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

POST /callback/?channel=s9C5b&id=94351&action=completed HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;charset=utf-8
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:45 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Via: 1.1 google
DNS

x2.c.lencr.org

Synapse X Free - UWP 2.598_94351.exe

Remote address:

8.8.8.8:53

Request

x2.c.lencr.org

IN A

Response

x2.c.lencr.org

IN CNAME

crl.root-x1.letsencrypt.org.edgekey.net

crl.root-x1.letsencrypt.org.edgekey.net

IN CNAME

e8652.dscx.akamaiedge.net

e8652.dscx.akamaiedge.net

IN A

23.222.33.142
GET

http://x2.c.lencr.org/

Synapse X Free - UWP 2.598_94351.exe

Remote address:

23.222.33.142:80

Request

GET / HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: x2.c.lencr.org

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/pkix-crl
Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
ETag: "64cd6654-12c"
Cache-Control: max-age=3600
Expires: Thu, 17 Aug 2023 15:52:37 GMT
Date: Thu, 17 Aug 2023 14:52:37 GMT
Content-Length: 300
Connection: keep-alive
GET

http://x2.c.lencr.org/

Synapse X Free - UWP 2.598_94351.exe

Remote address:

23.222.33.142:80

Request

GET / HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: x2.c.lencr.org

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/pkix-crl
Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT
ETag: "64cd6654-12c"
Cache-Control: max-age=3600
Expires: Thu, 17 Aug 2023 15:52:37 GMT
Date: Thu, 17 Aug 2023 14:52:37 GMT
Content-Length: 300
Connection: keep-alive
DNS

0.96.114.188.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.96.114.188.in-addr.arpa

IN PTR

Response
DNS

0.96.114.188.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.96.114.188.in-addr.arpa

IN PTR

Response
DNS

142.33.222.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

142.33.222.23.in-addr.arpa

IN PTR

Response

142.33.222.23.in-addr.arpa

IN PTR

a23-222-33-142deploystaticakamaitechnologiescom
DNS

142.33.222.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

142.33.222.23.in-addr.arpa

IN PTR

Response

142.33.222.23.in-addr.arpa

IN PTR

a23-222-33-142deploystaticakamaitechnologiescom
DNS

41.26.24.184.in-addr.arpa

Remote address:

8.8.8.8:53

Request

41.26.24.184.in-addr.arpa

IN PTR

Response

41.26.24.184.in-addr.arpa

IN PTR

a184-24-26-41deploystaticakamaitechnologiescom
DNS

flow.lavasoft.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

flow.lavasoft.com

IN A

Response

flow.lavasoft.com

IN A

104.17.9.52

flow.lavasoft.com

IN A

104.17.8.52
DNS

flow.lavasoft.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

flow.lavasoft.com

IN A

Response

flow.lavasoft.com

IN A

104.17.9.52

flow.lavasoft.com

IN A

104.17.8.52
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleInstallStart

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleInstallStart HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 2243
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:39 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bdfc494fb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 273

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:40 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0238cdb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleProposedOffers

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleProposedOffers HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 33034

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:41 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be049bb5b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 468

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:41 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be087fc5b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 456

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:41 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be097900b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 473

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0a5ad4b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 458

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0b5c37b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 405

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0c2d6fb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 443

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0daf03b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 434

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0f6947b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 433

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be125c92b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 448

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be18cbbdb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 428

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be1a7d8fb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 420

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be1b6ec3b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 420

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be1c680bb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 467

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:45 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be203c52b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 427

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:45 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be21adeeb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOffersApproved

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOffersApproved HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 1632

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:46 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be26db77b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferPageShowDelay

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferPageShowDelay HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 336

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:59 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be763e8ab987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PostbackRequest HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 320

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:59 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be77982bb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 501

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:59 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be78899cb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 267

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:59 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be795a67b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PostbackRequest HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 320

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:05 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be9c2cc5b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 463

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:05 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be9d9e7cb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 267

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:05 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be9e7f67b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PostbackRequest HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 320

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:07 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bea718e7b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 492

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:07 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bea839edb987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 267

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:07 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bea95ae8b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferCancel

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferCancel HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 437

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:04 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82c00baf94b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=InstallCancel

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=InstallCancel HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Length: 290

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:04 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82c00d1a24b987-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleInstallStart

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleInstallStart HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 2243
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:39 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bdfc4f930e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 273

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:40 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0218920e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleProposedOffers

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleProposedOffers HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 33043

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:41 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0859290e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 468

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0a4bd10e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 456

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0b3cd50e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 481

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0c2e4e0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 458

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0d0fa10e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 405

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0df8de0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 443

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0efa340e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 434

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be0feb8e0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 428

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be110cf60e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 433

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be123efc0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 448

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be18d8ff0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 420

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be1a7b360e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 420

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be1b7d3d0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 467

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:45 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be1f4a840e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 427

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:45 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be21ada40e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOffersApproved

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOffersApproved HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 1632

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:46 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be273d0e0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferPageShowDelay

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferPageShowDelay HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 337

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:46 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be283e3a0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PostbackRequest HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 319

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:47 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be293f760e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 500

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:47 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be2a18880e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 266

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:47 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be2b9a7d0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PostbackRequest HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 320

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:49 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be37eb820e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 463

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:49 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be38ed190e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 267

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:49 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be39ce640e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PostbackRequest HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 320

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:51 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be458f150e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 492

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:51 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be4698ad0e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 267

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:51 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be4779b50e3a-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Length: 272

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:55 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be5f49fa0e3a-AMS
DNS

sos.adaware.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

sos.adaware.com

IN A

Response

sos.adaware.com

IN A

104.18.68.73

sos.adaware.com

IN A

104.18.67.73
DNS

sos.adaware.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

sos.adaware.com

IN A

Response

sos.adaware.com

IN A

104.18.68.73

sos.adaware.com

IN A

104.18.67.73
POST

https://sos.adaware.com/v1/bundle/list?bundleId=DT001

setup94351.exe

Remote address:

104.18.68.73:443

Request

POST /v1/bundle/list?bundleId=DT001 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Content-Type: application/json;charset=utf-8
Host: sos.adaware.com
Content-Length: 340
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:40 GMT
Content-Type: application/json
Content-Length: 50774
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bdff1fde0b8e-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=6fbc973ae45295355324b69cee87937bc4057e68

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=6fbc973ae45295355324b69cee87937bc4057e68 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json
Content-Length: 309729
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 14:14:47 GMT
Expires: Thu, 17 Aug 2023 15:22:41 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be06699b0b8e-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=dbd004e0057c583d45a95f18ed713e7ef45ef93e

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=dbd004e0057c583d45a95f18ed713e7ef45ef93e HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json
Content-Length: 41861
Connection: keep-alive
CF-Cache-Status: MISS
Last-Modified: Thu, 17 Aug 2023 14:52:43 GMT
Expires: Thu, 17 Aug 2023 15:22:43 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be0e6b470b8e-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json
Content-Length: 218009
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 13:07:06 GMT
Expires: Thu, 17 Aug 2023 15:22:43 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be123fe50b8e-AMS
POST

https://sos.adaware.com/v1/bundle/list?bundleId=DT001

setup94351.exe

Remote address:

104.18.68.73:443

Request

POST /v1/bundle/list?bundleId=DT001 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Content-Type: application/json;charset=utf-8
Host: sos.adaware.com
Content-Length: 340
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:40 GMT
Content-Type: application/json
Content-Length: 50766
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bdff1d1fb93e-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=6fbc973ae45295355324b69cee87937bc4057e68

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=6fbc973ae45295355324b69cee87937bc4057e68 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json
Content-Length: 309729
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 14:03:49 GMT
Expires: Thu, 17 Aug 2023 15:22:41 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be066d5ab93e-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=dbd004e0057c583d45a95f18ed713e7ef45ef93e

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=dbd004e0057c583d45a95f18ed713e7ef45ef93e HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json
Content-Length: 41861
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Wed, 16 Aug 2023 18:34:22 GMT
Expires: Thu, 17 Aug 2023 15:22:43 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be0edfc8b93e-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json
Content-Length: 218009
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 11:23:18 GMT
Expires: Thu, 17 Aug 2023 15:22:44 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be14ef96b93e-AMS
DNS

52.9.17.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

52.9.17.104.in-addr.arpa

IN PTR

Response
DNS

52.9.17.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

52.9.17.104.in-addr.arpa

IN PTR

Response
DNS

73.68.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.68.18.104.in-addr.arpa

IN PTR

Response
DNS

73.68.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.68.18.104.in-addr.arpa

IN PTR

Response
GET

https://sos.adaware.com/v1/offer/detail?_id=574e67ffa35da5479ff8e7d0a60990fb5dedbf5c

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=574e67ffa35da5479ff8e7d0a60990fb5dedbf5c HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:41 GMT
Content-Type: application/json
Content-Length: 6529
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 14:12:57 GMT
Expires: Thu, 17 Aug 2023 15:22:41 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be058b92b972-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=ed9a2bc53ed0784001f05338acad53468e3c9a92

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=ed9a2bc53ed0784001f05338acad53468e3c9a92 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json
Content-Length: 80852
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Wed, 16 Aug 2023 18:34:18 GMT
Expires: Thu, 17 Aug 2023 15:22:42 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be09a9f7b972-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=ae1ec72a95b1edba3c28eabe896ef521ee41a67e

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=ae1ec72a95b1edba3c28eabe896ef521ee41a67e HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json
Content-Length: 33348
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 11:23:16 GMT
Expires: Thu, 17 Aug 2023 15:22:43 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be0f6a8bb972-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json
Content-Length: 27670
Connection: keep-alive
CF-Cache-Status: HIT
Age: 1310
Last-Modified: Thu, 17 Aug 2023 14:30:54 GMT
Expires: Thu, 17 Aug 2023 15:22:44 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be18bff0b972-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json
Content-Length: 818083
Connection: keep-alive
CF-Cache-Status: HIT
Age: 0
Last-Modified: Thu, 17 Aug 2023 14:52:44 GMT
Expires: Thu, 17 Aug 2023 15:22:44 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be1a6a19b972-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=574e67ffa35da5479ff8e7d0a60990fb5dedbf5c

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=574e67ffa35da5479ff8e7d0a60990fb5dedbf5c HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:41 GMT
Content-Type: application/json
Content-Length: 6529
Connection: keep-alive
CF-Cache-Status: HIT
Age: 0
Last-Modified: Thu, 17 Aug 2023 14:52:41 GMT
Expires: Thu, 17 Aug 2023 15:22:41 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be062d66b8f7-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=ed9a2bc53ed0784001f05338acad53468e3c9a92

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=ed9a2bc53ed0784001f05338acad53468e3c9a92 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/json
Content-Length: 80852
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Wed, 16 Aug 2023 18:34:18 GMT
Expires: Thu, 17 Aug 2023 15:22:42 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be09da97b8f7-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=ae1ec72a95b1edba3c28eabe896ef521ee41a67e

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=ae1ec72a95b1edba3c28eabe896ef521ee41a67e HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json
Content-Length: 33348
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 11:23:16 GMT
Expires: Thu, 17 Aug 2023 15:22:43 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be0f8a69b8f7-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json
Content-Length: 27670
Connection: keep-alive
CF-Cache-Status: HIT
Age: 1310
Last-Modified: Thu, 17 Aug 2023 14:30:54 GMT
Expires: Thu, 17 Aug 2023 15:22:44 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be179d67b8f7-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/json
Content-Length: 818083
Connection: keep-alive
CF-Cache-Status: MISS
Last-Modified: Thu, 17 Aug 2023 14:52:44 GMT
Expires: Thu, 17 Aug 2023 15:22:44 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be18cf13b8f7-AMS
DNS

webcf.quickdriverupdater.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

webcf.quickdriverupdater.com

IN A

Response

webcf.quickdriverupdater.com

IN CNAME

d3r4f1s63ob1dl.cloudfront.net

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.89

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.88

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.92

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.98
DNS

webcf.quickdriverupdater.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

webcf.quickdriverupdater.com

IN A

Response

webcf.quickdriverupdater.com

IN CNAME

d3r4f1s63ob1dl.cloudfront.net

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.98

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.88

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.89

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.92
HEAD

https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

setup94351.exe

Remote address:

52.222.139.89:443

Request

HEAD /win/qdu/builds/v1013/qdurtsetup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: webcf.quickdriverupdater.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: application/x-msdownload
Content-Length: 6740568
Connection: keep-alive
Last-Modified: Tue, 01 Feb 2022 10:15:56 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Thu, 17 Aug 2023 02:24:24 GMT
ETag: "4aae3da061f772f90bae6902c72f7cf2"
X-Cache: Hit from cloudfront
Via: 1.1 4f516e51d4c38a41272c9098bf829774.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS50-C1
X-Amz-Cf-Id: rnz7z53mHcUkduYlRtRQ_uu96TAApGwazCnYOQHlNmDsSo02n5OVAA==
Age: 45093
HEAD

https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

setup94351.exe

Remote address:

52.222.139.89:443

Request

HEAD /win/qdu/builds/v1013/qdurtsetup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: webcf.quickdriverupdater.com

Response

HTTP/1.1 200 OK

Content-Type: application/x-msdownload
Content-Length: 6740568
Connection: keep-alive
Last-Modified: Tue, 01 Feb 2022 10:15:56 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Thu, 17 Aug 2023 03:53:05 GMT
ETag: "4aae3da061f772f90bae6902c72f7cf2"
X-Cache: Hit from cloudfront
Via: 1.1 4f516e51d4c38a41272c9098bf829774.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS50-C1
X-Amz-Cf-Id: egbi0w-t70C98D_6APA62eeT8qdOf-Ct4r0UrevUb7G5JhXGsN0Cng==
Age: 45093
HEAD

https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

setup94351.exe

Remote address:

52.222.139.89:443

Request

HEAD /win/qdu/builds/v1013/qdurtsetup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: webcf.quickdriverupdater.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: application/x-msdownload
Content-Length: 6740568
Connection: keep-alive
Last-Modified: Tue, 01 Feb 2022 10:15:56 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Thu, 17 Aug 2023 02:24:24 GMT
ETag: "4aae3da061f772f90bae6902c72f7cf2"
X-Cache: Hit from cloudfront
Via: 1.1 b2bc712713f500af8be071fa65fa924c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS50-C1
X-Amz-Cf-Id: ae8weprmH3XrCus1G2QKuYOtR9DGBzaVBdH8Zb2Kr1LdWJd7Jc0Aag==
Age: 45093
HEAD

https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

setup94351.exe

Remote address:

52.222.139.89:443

Request

HEAD /win/qdu/builds/v1013/qdurtsetup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: webcf.quickdriverupdater.com

Response

HTTP/1.1 200 OK

Content-Type: application/x-msdownload
Content-Length: 6740568
Connection: keep-alive
Last-Modified: Tue, 01 Feb 2022 10:15:56 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Thu, 17 Aug 2023 02:24:24 GMT
ETag: "4aae3da061f772f90bae6902c72f7cf2"
X-Cache: Hit from cloudfront
Via: 1.1 b2bc712713f500af8be071fa65fa924c.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS50-C1
X-Amz-Cf-Id: vO5OxC9yfr52ic9xf6txQjcBABo2ilXG_gn7exc0MYgDGHHK46Rjiw==
Age: 45093
DNS

89.139.222.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

89.139.222.52.in-addr.arpa

IN PTR

Response

89.139.222.52.in-addr.arpa

IN PTR

server-52-222-139-89ams50r cloudfrontnet
DNS

net.geo.opera.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

net.geo.opera.com

IN A

Response

net.geo.opera.com

IN CNAME

eu.net.opera.com

eu.net.opera.com

IN A

185.26.182.112

eu.net.opera.com

IN A

185.26.182.111
HEAD

https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

setup94351.exe

Remote address:

185.26.182.112:443

Request

HEAD /opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: net.geo.opera.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/octet-stream
Connection: keep-alive
Content-Disposition: attachment; filename=OperaSetup.exe
Strict-Transport-Security: max-age=31536000; includeSubDomains
HEAD

https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

setup94351.exe

Remote address:

185.26.182.112:443

Request

HEAD /opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: net.geo.opera.com

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/octet-stream
Connection: keep-alive
Content-Disposition: attachment; filename=OperaSetup.exe
Strict-Transport-Security: max-age=31536000; includeSubDomains
HEAD

https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

setup94351.exe

Remote address:

185.26.182.112:443

Request

HEAD /opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: net.geo.opera.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/octet-stream
Connection: keep-alive
Content-Disposition: attachment; filename=OperaSetup.exe
Strict-Transport-Security: max-age=31536000; includeSubDomains
HEAD

https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

setup94351.exe

Remote address:

185.26.182.112:443

Request

HEAD /opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: net.geo.opera.com

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:52:42 GMT
Content-Type: application/octet-stream
Connection: keep-alive
Content-Disposition: attachment; filename=OperaSetup.exe
Strict-Transport-Security: max-age=31536000; includeSubDomains
DNS

download.winzip.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

download.winzip.com

IN A

Response

download.winzip.com

IN CNAME

www.winzip1.com.edgekey.net

www.winzip1.com.edgekey.net

IN CNAME

e94167.b.akamaiedge.net

e94167.b.akamaiedge.net

IN A

2.19.195.193

e94167.b.akamaiedge.net

IN A

2.19.195.232
HEAD

https://download.winzip.com/nkln/27/winzip_mul_64.msi

setup94351.exe

Remote address:

2.19.195.193:443

Request

HEAD /nkln/27/winzip_mul_64.msi HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.winzip.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Length: 216237056
Content-Type: text/plain
ETag: "d92453bc245cf1f8482aaf96a85d5280:1661296616.331573"
Last-Modified: Tue, 23 Aug 2022 23:17:20 GMT
Server: AkamaiNetStorage
Date: Thu, 17 Aug 2023 14:52:42 GMT
Connection: keep-alive
HEAD

https://download.winzip.com/nkln/27/winzip_mul_64.msi

setup94351.exe

Remote address:

2.19.195.193:443

Request

HEAD /nkln/27/winzip_mul_64.msi HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.winzip.com

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Length: 216237056
Content-Type: text/plain
ETag: "d92453bc245cf1f8482aaf96a85d5280:1661296616.331573"
Last-Modified: Tue, 23 Aug 2022 23:17:20 GMT
Server: AkamaiNetStorage
Date: Thu, 17 Aug 2023 14:52:42 GMT
Connection: keep-alive
HEAD

https://download.winzip.com/nkln/27/winzip_mul_64.msi

setup94351.exe

Remote address:

2.19.195.193:443

Request

HEAD /nkln/27/winzip_mul_64.msi HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.winzip.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Length: 216237056
Content-Type: text/plain
ETag: "d92453bc245cf1f8482aaf96a85d5280:1661296616.331573"
Last-Modified: Tue, 23 Aug 2022 23:17:20 GMT
Server: AkamaiNetStorage
Date: Thu, 17 Aug 2023 14:52:42 GMT
Connection: keep-alive
HEAD

https://download.winzip.com/nkln/27/winzip_mul_64.msi

setup94351.exe

Remote address:

2.19.195.193:443

Request

HEAD /nkln/27/winzip_mul_64.msi HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.winzip.com

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Length: 216237056
Content-Type: text/plain
ETag: "d92453bc245cf1f8482aaf96a85d5280:1661296616.331573"
Last-Modified: Tue, 23 Aug 2022 23:17:20 GMT
Server: AkamaiNetStorage
Date: Thu, 17 Aug 2023 14:52:42 GMT
Connection: keep-alive
GET

https://sos.adaware.com/v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: a39d5c53-60ff-452e-b135-f4bf469c3bf1
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json
Content-Length: 51612
Connection: keep-alive
CF-Cache-Status: HIT
Age: 885
Last-Modified: Thu, 17 Aug 2023 14:37:58 GMT
Expires: Thu, 17 Aug 2023 15:22:43 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be10be8d1c86-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: 8239bada-629c-4622-b536-832799c1d553
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/json
Content-Length: 51612
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 14:03:47 GMT
Expires: Thu, 17 Aug 2023 15:22:43 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82be10cd75b8be-AMS
DNS

bits.avcdn.net

setup94351.exe

Remote address:

8.8.8.8:53

Request

bits.avcdn.net

IN A

Response

bits.avcdn.net

IN CNAME

bits.avast.com-v1.edgekey.net

bits.avast.com-v1.edgekey.net

IN CNAME

e4682.dscd.akamaiedge.net

e4682.dscd.akamaiedge.net

IN A

23.206.85.138
DNS

bits.avcdn.net

setup94351.exe

Remote address:

8.8.8.8:53

Request

bits.avcdn.net

IN A

Response

bits.avcdn.net

IN CNAME

bits.avast.com-v1.edgekey.net

bits.avast.com-v1.edgekey.net

IN CNAME

e4682.dscd.akamaiedge.net

e4682.dscd.akamaiedge.net

IN A

23.206.85.138
HEAD

https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

setup94351.exe

Remote address:

23.206.85.138:443

Request

HEAD /platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 263576
Last-Modified: Sat, 12 Aug 2023 05:42:59 GMT
ETag: "64d71be3-40598"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="avast_free_antivirus_setup_online.exe"
Date: Thu, 17 Aug 2023 14:52:43 GMT
Connection: keep-alive
HEAD

https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

setup94351.exe

Remote address:

23.206.85.138:443

Request

HEAD /platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 263576
Last-Modified: Sat, 12 Aug 2023 05:42:59 GMT
ETag: "64d71be3-40598"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="avast_free_antivirus_setup_online.exe"
Date: Thu, 17 Aug 2023 14:52:43 GMT
Connection: keep-alive
DNS

download.enigmasoftware.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

download.enigmasoftware.com

IN A

Response

download.enigmasoftware.com

IN A

18.65.39.95

download.enigmasoftware.com

IN A

18.65.39.113

download.enigmasoftware.com

IN A

18.65.39.4

download.enigmasoftware.com

IN A

18.65.39.106
DNS

download.enigmasoftware.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

download.enigmasoftware.com

IN A

Response

download.enigmasoftware.com

IN A

18.65.39.95

download.enigmasoftware.com

IN A

18.65.39.113

download.enigmasoftware.com

IN A

18.65.39.4

download.enigmasoftware.com

IN A

18.65.39.106
HEAD

https://download.enigmasoftware.com/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

setup94351.exe

Remote address:

18.65.39.95:443

Request

HEAD /spyhunter-free-download/silent/lav/SpyHunter-Installer.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.enigmasoftware.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Length: 0
Connection: keep-alive
Date: Thu, 17 Aug 2023 10:30:28 GMT
Location: https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 2f7b5be8899520ed019685dc425dc306.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS1-P1
X-Amz-Cf-Id: czBabzRcyYAIGlDvzSmAWdIgfFKn5kDbxvU1N1FdISNfKdM6cA16lw==
Age: 15736
HEAD

https://download.enigmasoftware.com/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

setup94351.exe

Remote address:

18.65.39.95:443

Request

HEAD /spyhunter-free-download/silent/lav/SpyHunter-Installer.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.enigmasoftware.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Length: 0
Connection: keep-alive
Date: Thu, 17 Aug 2023 10:30:28 GMT
Location: https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 5e1e1cde81deec56515dcc5317501fe8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS1-P1
X-Amz-Cf-Id: bQzOoesyEIrfvmMAF_Mrx15_ASjJjB62MsXg3DRCuWEI1UFBnCb1zQ==
Age: 15736
DNS

spyhunter-download-v2.b-cdn.net

setup94351.exe

Remote address:

8.8.8.8:53

Request

spyhunter-download-v2.b-cdn.net

IN A

Response

spyhunter-download-v2.b-cdn.net

IN A

103.180.115.13
HEAD

https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

setup94351.exe

Remote address:

103.180.115.13:443

Request

HEAD /spyhunter-free-download/silent/lav/SpyHunter-Installer.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: spyhunter-download-v2.b-cdn.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/octet-stream
Content-Length: 6893544
Connection: keep-alive
Server: BunnyCDN-CEN1-1045
CDN-PullZone: 1053841
CDN-Uid: 27a71848-22f2-45db-b801-7c7517de9523
CDN-RequestCountryCode: IN
Cache-Control: public, max-age=2592000
ETag: "c63e20841fed7e3fef9c88f91d8ad413"
Last-Modified: Thu, 02 Mar 2023 16:40:50 GMT
x-amz-id-2: 0w8CHQqsNCdvxpuxRncLuJ7zhI22Q3FylWsFQAnDQ45dXFNOvSaOkVR14+4J6ZLs30uNeTdi6N8=
x-amz-request-id: J76YCR1EHYX5N9A6
x-amz-server-side-encryption: AES256
x-amz-meta-cb-modifiedtime: Wed, 01 Mar 2023 16:20:29 GMT
CDN-ProxyVer: 1.03
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 200
CDN-CachedAt: 06/27/2023 06:05:50
CDN-EdgeStorageId: 1045
CDN-Status: 200
CDN-RequestId: 69fcbd7a586c1194f28fd3c49fb868cd
CDN-Cache: HIT
Accept-Ranges: bytes
HEAD

https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

setup94351.exe

Remote address:

103.180.115.13:443

Request

HEAD /spyhunter-free-download/silent/lav/SpyHunter-Installer.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: spyhunter-download-v2.b-cdn.net

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/octet-stream
Content-Length: 6893544
Connection: keep-alive
Server: BunnyCDN-CEN1-1045
CDN-PullZone: 1053841
CDN-Uid: 27a71848-22f2-45db-b801-7c7517de9523
CDN-RequestCountryCode: IN
Cache-Control: public, max-age=2592000
ETag: "c63e20841fed7e3fef9c88f91d8ad413"
Last-Modified: Thu, 02 Mar 2023 16:40:50 GMT
x-amz-id-2: 0w8CHQqsNCdvxpuxRncLuJ7zhI22Q3FylWsFQAnDQ45dXFNOvSaOkVR14+4J6ZLs30uNeTdi6N8=
x-amz-request-id: J76YCR1EHYX5N9A6
x-amz-server-side-encryption: AES256
x-amz-meta-cb-modifiedtime: Wed, 01 Mar 2023 16:20:29 GMT
CDN-ProxyVer: 1.03
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 200
CDN-CachedAt: 06/27/2023 06:05:50
CDN-EdgeStorageId: 1045
CDN-Status: 200
CDN-RequestId: 063166b8e33be93c6955d9700db01ad4
CDN-Cache: HIT
Accept-Ranges: bytes
HEAD

https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

setup94351.exe

Remote address:

103.180.115.13:443

Request

HEAD /spyhunter-free-download/silent/lav/SpyHunter-Installer.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: spyhunter-download-v2.b-cdn.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:43 GMT
Content-Type: application/octet-stream
Content-Length: 6893544
Connection: keep-alive
Server: BunnyCDN-CEN1-1045
CDN-PullZone: 1053841
CDN-Uid: 27a71848-22f2-45db-b801-7c7517de9523
CDN-RequestCountryCode: IN
Cache-Control: public, max-age=2592000
ETag: "c63e20841fed7e3fef9c88f91d8ad413"
Last-Modified: Thu, 02 Mar 2023 16:40:50 GMT
x-amz-id-2: 0w8CHQqsNCdvxpuxRncLuJ7zhI22Q3FylWsFQAnDQ45dXFNOvSaOkVR14+4J6ZLs30uNeTdi6N8=
x-amz-request-id: J76YCR1EHYX5N9A6
x-amz-server-side-encryption: AES256
x-amz-meta-cb-modifiedtime: Wed, 01 Mar 2023 16:20:29 GMT
CDN-ProxyVer: 1.03
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 200
CDN-CachedAt: 06/27/2023 06:05:50
CDN-EdgeStorageId: 1045
CDN-Status: 200
CDN-RequestId: b7ee6c90bf363b01f2f6717a679283f2
CDN-Cache: HIT
Accept-Ranges: bytes
HEAD

https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

setup94351.exe

Remote address:

103.180.115.13:443

Request

HEAD /spyhunter-free-download/silent/lav/SpyHunter-Installer.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: spyhunter-download-v2.b-cdn.net

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:44 GMT
Content-Type: application/octet-stream
Content-Length: 6893544
Connection: keep-alive
Server: BunnyCDN-CEN1-1045
CDN-PullZone: 1053841
CDN-Uid: 27a71848-22f2-45db-b801-7c7517de9523
CDN-RequestCountryCode: IN
Cache-Control: public, max-age=2592000
ETag: "c63e20841fed7e3fef9c88f91d8ad413"
Last-Modified: Thu, 02 Mar 2023 16:40:50 GMT
x-amz-id-2: 0w8CHQqsNCdvxpuxRncLuJ7zhI22Q3FylWsFQAnDQ45dXFNOvSaOkVR14+4J6ZLs30uNeTdi6N8=
x-amz-request-id: J76YCR1EHYX5N9A6
x-amz-server-side-encryption: AES256
x-amz-meta-cb-modifiedtime: Wed, 01 Mar 2023 16:20:29 GMT
CDN-ProxyVer: 1.03
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 200
CDN-CachedAt: 06/27/2023 06:05:50
CDN-EdgeStorageId: 1045
CDN-Status: 200
CDN-RequestId: 3957b0e05c5f12b12a8c250fd1f8c2b3
CDN-Cache: HIT
Accept-Ranges: bytes
DNS

112.182.26.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

112.182.26.185.in-addr.arpa

IN PTR

Response
DNS

193.195.19.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

193.195.19.2.in-addr.arpa

IN PTR

Response

193.195.19.2.in-addr.arpa

IN PTR

a2-19-195-193deploystaticakamaitechnologiescom
DNS

138.85.206.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

138.85.206.23.in-addr.arpa

IN PTR

Response

138.85.206.23.in-addr.arpa

IN PTR

a23-206-85-138deploystaticakamaitechnologiescom
DNS

138.85.206.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

138.85.206.23.in-addr.arpa

IN PTR

Response

138.85.206.23.in-addr.arpa

IN PTR

a23-206-85-138deploystaticakamaitechnologiescom
DNS

95.39.65.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.39.65.18.in-addr.arpa

IN PTR

Response

95.39.65.18.in-addr.arpa

IN PTR

server-18-65-39-95ams1r cloudfrontnet
DNS

cdn-download.avgbrowser.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

cdn-download.avgbrowser.com

IN A

Response

cdn-download.avgbrowser.com

IN CNAME

cdn-prod-download.browser.akamaized.net

cdn-prod-download.browser.akamaized.net

IN CNAME

a333.dscd.akamai.net

a333.dscd.akamai.net

IN A

88.221.135.209

a333.dscd.akamai.net

IN A

88.221.134.51
HEAD

https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

setup94351.exe

Remote address:

88.221.135.209:443

Request

HEAD /avg_secure_browser_setup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: cdn-download.avgbrowser.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: application/octet-stream
Content-Length: 6246416
Pragma: public
content-disposition: attachment; filename="avg_secure_browser_setup.exe"
Last-Modified: Tue, 06 Jun 2023 12:57:01 GMT
ETag: b019a44edace07b3200d1d70ccbfc8b5
Accept-Ranges: bytes
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f824fb1682bdd27-LHR
Cache-Control: public, must-revalidate, max-age=0, post-check=0, pre-check=0
Expires: Thu, 17 Aug 2023 14:52:44 GMT
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
HEAD

https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

setup94351.exe

Remote address:

88.221.135.209:443

Request

HEAD /avg_secure_browser_setup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: cdn-download.avgbrowser.com

Response

HTTP/1.1 200 OK

Content-Type: application/octet-stream
Content-Length: 6246416
Pragma: public
content-disposition: attachment; filename="avg_secure_browser_setup.exe"
Last-Modified: Tue, 06 Jun 2023 12:57:01 GMT
ETag: b019a44edace07b3200d1d70ccbfc8b5
Accept-Ranges: bytes
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f824fb1682bdd27-LHR
Cache-Control: public, must-revalidate, max-age=0, post-check=0, pre-check=0
Expires: Thu, 17 Aug 2023 14:52:44 GMT
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
HEAD

https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

setup94351.exe

Remote address:

88.221.135.209:443

Request

HEAD /avg_secure_browser_setup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: cdn-download.avgbrowser.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: application/octet-stream
Content-Length: 6246416
Pragma: public
content-disposition: attachment; filename="avg_secure_browser_setup.exe"
Last-Modified: Tue, 06 Jun 2023 12:57:01 GMT
ETag: b019a44edace07b3200d1d70ccbfc8b5
Accept-Ranges: bytes
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f824fb1682bdd27-LHR
Cache-Control: public, must-revalidate, max-age=0, post-check=0, pre-check=0
Expires: Thu, 17 Aug 2023 14:52:44 GMT
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
HEAD

https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

setup94351.exe

Remote address:

88.221.135.209:443

Request

HEAD /avg_secure_browser_setup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: cdn-download.avgbrowser.com

Response

HTTP/1.1 200 OK

Content-Type: application/octet-stream
Content-Length: 6246416
Pragma: public
content-disposition: attachment; filename="avg_secure_browser_setup.exe"
Last-Modified: Tue, 06 Jun 2023 12:57:01 GMT
ETag: b019a44edace07b3200d1d70ccbfc8b5
Accept-Ranges: bytes
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f824fb1682bdd27-LHR
Cache-Control: public, must-revalidate, max-age=0, post-check=0, pre-check=0
Expires: Thu, 17 Aug 2023 14:52:44 GMT
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
HEAD

https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

setup94351.exe

Remote address:

23.206.85.138:443

Request

HEAD /productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 50681544
Last-Modified: Wed, 16 Aug 2023 10:59:08 GMT
ETag: "64dcabfc-30556c8"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="ccsetup615_slim.exe"
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
HEAD

https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

setup94351.exe

Remote address:

23.206.85.138:443

Request

HEAD /productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 50681544
Last-Modified: Wed, 16 Aug 2023 10:59:08 GMT
ETag: "64dcabfc-30556c8"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="ccsetup615_slim.exe"
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
HEAD

https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

setup94351.exe

Remote address:

23.206.85.138:443

Request

HEAD /platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 263576
Last-Modified: Sat, 12 Aug 2023 05:42:59 GMT
ETag: "64d71be3-40598"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="avast_free_antivirus_setup_online.exe"
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
HEAD

https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

setup94351.exe

Remote address:

23.206.85.138:443

Request

HEAD /platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 263576
Last-Modified: Sat, 12 Aug 2023 05:42:59 GMT
ETag: "64d71be3-40598"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="avast_free_antivirus_setup_online.exe"
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
DNS

download2021.pdf-suite.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

download2021.pdf-suite.com

IN A

Response

download2021.pdf-suite.com

IN A

198.72.111.246
DNS

setup94351.exe

Remote address:

198.72.111.246:443

Response

HTTP/1.0 400 Bad request

Cache-Control: no-cache
Connection: close
Content-Type: text/html
HEAD

https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

setup94351.exe

Remote address:

23.206.85.138:443

Request

HEAD /productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 50681544
Last-Modified: Wed, 16 Aug 2023 10:59:08 GMT
ETag: "64dcabfc-30556c8"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="ccsetup615_slim.exe"
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
HEAD

https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

setup94351.exe

Remote address:

23.206.85.138:443

Request

HEAD /productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 50681544
Last-Modified: Wed, 16 Aug 2023 10:59:08 GMT
ETag: "64dcabfc-30556c8"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="ccsetup615_slim.exe"
Date: Thu, 17 Aug 2023 14:52:44 GMT
Connection: keep-alive
DNS

13.115.180.103.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.115.180.103.in-addr.arpa

IN PTR

Response
DNS

13.115.180.103.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.115.180.103.in-addr.arpa

IN PTR

Response
DNS

209.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.135.221.88.in-addr.arpa

IN PTR

Response

209.135.221.88.in-addr.arpa

IN PTR

a88-221-135-209deploystaticakamaitechnologiescom
DNS

setup94351.exe

Remote address:

198.72.111.246:443

Response

HTTP/1.0 400 Bad request

Cache-Control: no-cache
Connection: close
Content-Type: text/html
DNS

download.terabyteunlimited.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

download.terabyteunlimited.com

IN A

Response

download.terabyteunlimited.com

IN A

50.62.141.182
DNS

download.terabyteunlimited.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

download.terabyteunlimited.com

IN A

Response

download.terabyteunlimited.com

IN A

50.62.141.182
DNS

246.111.72.198.in-addr.arpa

Remote address:

8.8.8.8:53

Request

246.111.72.198.in-addr.arpa

IN PTR

Response
DNS

246.111.72.198.in-addr.arpa

Remote address:

8.8.8.8:53

Request

246.111.72.198.in-addr.arpa

IN PTR

Response
HEAD

http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

setup94351.exe

Remote address:

50.62.141.182:80

Request

HEAD /terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.terabyteunlimited.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:46 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Thu, 13 Jul 2023 02:24:37 GMT
ETag: "3f01a8e-b53d088-6005508a21a01"
Accept-Ranges: bytes
Content-Length: 190042248
Vary: Accept-Encoding
Keep-Alive: timeout=5
Content-Type: application/x-msdownload
HEAD

http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

setup94351.exe

Remote address:

50.62.141.182:80

Request

HEAD /terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.terabyteunlimited.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:46 GMT
Server: Apache
Last-Modified: Thu, 13 Jul 2023 02:24:37 GMT
ETag: "3f01a8e-b53d088-6005508a21a01"
Accept-Ranges: bytes
Content-Length: 190042248
Vary: Accept-Encoding
Content-Type: application/x-msdownload
HEAD

http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

setup94351.exe

Remote address:

50.62.141.182:80

Request

HEAD /terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.terabyteunlimited.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:46 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Thu, 13 Jul 2023 02:24:37 GMT
ETag: "3f01a8e-b53d088-6005508a21a01"
Accept-Ranges: bytes
Content-Length: 190042248
Vary: Accept-Encoding
Keep-Alive: timeout=5
Content-Type: application/x-msdownload
HEAD

http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

setup94351.exe

Remote address:

50.62.141.182:80

Request

HEAD /terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.terabyteunlimited.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:46 GMT
Server: Apache
Last-Modified: Thu, 13 Jul 2023 02:24:37 GMT
ETag: "3f01a8e-b53d088-6005508a21a01"
Accept-Ranges: bytes
Content-Length: 190042248
Vary: Accept-Encoding
Content-Type: application/x-msdownload
DNS

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-s1-v6exp3-v4.metric.gstatic.com

msedge.exe

Remote address:

8.8.8.8:53

Request

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-s1-v6exp3-v4.metric.gstatic.com

IN A

Response

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-s1-v6exp3-v4.metric.gstatic.com

IN A

216.58.214.3
DNS

182.141.62.50.in-addr.arpa

Remote address:

8.8.8.8:53

Request

182.141.62.50.in-addr.arpa

IN PTR

Response

182.141.62.50.in-addr.arpa

IN PTR

1821416250hostsecureservernet
DNS

182.141.62.50.in-addr.arpa

Remote address:

8.8.8.8:53

Request

182.141.62.50.in-addr.arpa

IN PTR

Response

182.141.62.50.in-addr.arpa

IN PTR

1821416250hostsecureservernet
DNS

3.214.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.214.58.216.in-addr.arpa

IN PTR

Response

3.214.58.216.in-addr.arpa

IN PTR

ams17s09-in-f31e100net

3.214.58.216.in-addr.arpa

IN PTR

lhr26s05-in-f3�F

3.214.58.216.in-addr.arpa

IN PTR

�]
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDeclined

OfferInstaller.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDeclined HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 6.2.9200.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid:
Content-Length: 461
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:57 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be6c4b470a6b-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDeclined

OfferInstaller.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDeclined HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 6.2.9200.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid:
Content-Length: 423

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be6e1d420a6b-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDeclined

OfferInstaller.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDeclined HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 6.2.9200.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid:
Content-Length: 469

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be6efe100a6b-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

OfferInstaller.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 6.2.9200.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid:
Content-Length: 477

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be6fdf090a6b-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

OfferInstaller.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 6.2.9200.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid:
Content-Length: 492

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be70c8040a6b-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

OfferInstaller.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 6.2.9200.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid:
Content-Length: 472

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be7199080a6b-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

OfferInstaller.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 6.2.9200.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid:
Content-Length: 464

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be7279d20a6b-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

OfferInstaller.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 6.2.9200.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid:
Content-Length: 471

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be736ae50a6b-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleInstallComplete

OfferInstaller.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleInstallComplete HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 6.2.9200.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid:
Content-Length: 897

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:52:59 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82be745bd70a6b-AMS
DNS

a.directfiledl.com

msedge.exe

Remote address:

8.8.8.8:53

Request

a.directfiledl.com

IN A

Response

a.directfiledl.com

IN A

167.235.218.62
GET

http://a.directfiledl.com/getfile?id=94351

msedge.exe

Remote address:

167.235.218.62:80

Request

GET /getfile?id=94351 HTTP/1.1
Host: a.directfiledl.com
Connection: keep-alive
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

x-powered-by: Express
cache-control: no-store
content-disposition: attachment; filename="Synapse X UWP - v2.598.zip"
accept-ranges: bytes
last-modified: Mon, 14 Aug 2023 23:39:32 GMT
etag: W/"857f4c-189f66b4583"
content-type: application/octet-stream
content-length: 8748876
date: Thu, 17 Aug 2023 14:53:50 GMT
keep-alive: timeout=5
DNS

msedge.exe

Remote address:

167.235.218.62:80

Response

HTTP/1.1 400 Bad request

Content-length: 90
Cache-Control: no-cache
Connection: close
Content-Type: text/html
DNS

62.218.235.167.in-addr.arpa

Remote address:

8.8.8.8:53

Request

62.218.235.167.in-addr.arpa

IN PTR

Response

62.218.235.167.in-addr.arpa

IN PTR

static62218235167clientsyour-serverde
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleInstallStart

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleInstallStart HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 2242
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:58 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bfe7789b1ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=PageShown HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 273

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:59 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bfeb4a061ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleProposedOffers

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleProposedOffers HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 33047

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:59 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bfef8b831ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 468

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:59 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bff10c3a1ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 503

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:00 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bff1ec8f1ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 456

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:00 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bff2cce51ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 486

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:00 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bff3cd471ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 458

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:00 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bff49d921ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 405

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:00 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bff58ded1ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 434

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:00 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bff66e4e1ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 433

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:00 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bff74ea51ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 448

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:01 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bffc98971ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 428

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:02 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bffe4a6f1ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 420

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:02 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82c0014b8b1ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 420

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:02 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82c0030c2f1ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOfferRejected HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 467

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:03 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82c006ad571ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 427

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:04 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82c00bbf401ece-AMS
POST

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOffersApproved

setup94351.exe

Remote address:

104.17.9.52:443

Request

POST /v1/event-stat/?ProductID=IS&Type=BundleOffersApproved HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
Content-Type: application/json;charset=utf-8
Host: flow.lavasoft.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Length: 1450

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:04 GMT
Content-Type: application/json; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Access-Control-Allow-Origin
Access-Control-Expose-Headers: Content-Length,Content-Range
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82c01089241ece-AMS
POST

https://sos.adaware.com/v1/bundle/list?bundleId=DT001

setup94351.exe

Remote address:

104.18.68.73:443

Request

POST /v1/bundle/list?bundleId=DT001 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Content-Type: application/json;charset=utf-8
Host: sos.adaware.com
Content-Length: 340
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:59 GMT
Content-Type: application/json
Content-Length: 50778
Connection: keep-alive
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f82bfe95f170e78-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=574e67ffa35da5479ff8e7d0a60990fb5dedbf5c

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=574e67ffa35da5479ff8e7d0a60990fb5dedbf5c HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:53:59 GMT
Content-Type: application/json
Content-Length: 6529
Connection: keep-alive
CF-Cache-Status: HIT
Age: 1316
Last-Modified: Thu, 17 Aug 2023 14:32:03 GMT
Expires: Thu, 17 Aug 2023 15:23:59 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82bfef9e9e0e78-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=ed9a2bc53ed0784001f05338acad53468e3c9a92

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=ed9a2bc53ed0784001f05338acad53468e3c9a92 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:00 GMT
Content-Type: application/json
Content-Length: 80852
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 13:07:05 GMT
Expires: Thu, 17 Aug 2023 15:24:00 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82bff01f220e78-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=ae1ec72a95b1edba3c28eabe896ef521ee41a67e

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=ae1ec72a95b1edba3c28eabe896ef521ee41a67e HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:01 GMT
Content-Type: application/json
Content-Length: 33348
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Wed, 16 Aug 2023 20:37:55 GMT
Expires: Thu, 17 Aug 2023 15:24:00 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82bff58e2b0e78-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:01 GMT
Content-Type: application/json
Content-Length: 51612
Connection: keep-alive
CF-Cache-Status: HIT
Age: 960
Last-Modified: Thu, 17 Aug 2023 14:38:01 GMT
Expires: Thu, 17 Aug 2023 15:24:01 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82bff9dc350e78-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:02 GMT
Content-Type: application/json
Content-Length: 218009
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Wed, 16 Aug 2023 16:15:28 GMT
Expires: Thu, 17 Aug 2023 15:24:02 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82bffc9fe50e78-AMS
GET

http://dlsft.com/callback/offers.php

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

GET /callback/offers.php HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:53:58 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 17
Via: 1.1 google
POST

http://dlsft.com/callback/geo/geo.php

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

POST /callback/geo/geo.php HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;charset=utf-8
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:53:58 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 18
Via: 1.1 google
GET

http://dlsft.com/callback/info.php?id=94351

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

GET /callback/info.php?id=94351 HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:53:58 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 283
Vary: Accept-Encoding
Content-Encoding: gzip
Via: 1.1 google
POST

http://dlsft.com/callback/?channel=s9C5b&id=94351&action=started

Synapse X Free - UWP 2.598_94351.exe

Remote address:

35.190.60.70:80

Request

POST /callback/?channel=s9C5b&id=94351&action=started HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded;charset=utf-8
User-Agent: sciter 4.3.0.0; Windows-8; www.sciter.com)
Host: dlsft.com
Content-Length: 0
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 17 Aug 2023 14:53:58 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Via: 1.1 google
DNS

webcf.quickdriverupdater.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

webcf.quickdriverupdater.com

IN A

Response

webcf.quickdriverupdater.com

IN CNAME

d3r4f1s63ob1dl.cloudfront.net

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.92

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.89

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.88

d3r4f1s63ob1dl.cloudfront.net

IN A

52.222.139.98
HEAD

https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

setup94351.exe

Remote address:

52.222.139.92:443

Request

HEAD /win/qdu/builds/v1013/qdurtsetup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: webcf.quickdriverupdater.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: application/x-msdownload
Content-Length: 6740568
Connection: keep-alive
Last-Modified: Tue, 01 Feb 2022 10:15:56 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Thu, 17 Aug 2023 02:24:24 GMT
ETag: "4aae3da061f772f90bae6902c72f7cf2"
X-Cache: Hit from cloudfront
Via: 1.1 5345148f0ba8ae3c67b69d035acdbfc4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS50-C1
X-Amz-Cf-Id: txvG9Qydkij5InWo8Jk53TGBXqx6aeVXlLjuS8m0dojo-v4pQUeZAQ==
Age: 45171
HEAD

https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

setup94351.exe

Remote address:

52.222.139.92:443

Request

HEAD /win/qdu/builds/v1013/qdurtsetup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: webcf.quickdriverupdater.com

Response

HTTP/1.1 200 OK

Content-Type: application/x-msdownload
Content-Length: 6740568
Connection: keep-alive
Last-Modified: Tue, 01 Feb 2022 10:15:56 GMT
Accept-Ranges: bytes
Server: AmazonS3
Date: Thu, 17 Aug 2023 13:22:18 GMT
ETag: "4aae3da061f772f90bae6902c72f7cf2"
X-Cache: Hit from cloudfront
Via: 1.1 5345148f0ba8ae3c67b69d035acdbfc4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS50-C1
X-Amz-Cf-Id: xmEW3K10EyBTmAjoKaT6sm81IKthg-iy1nPfxT0x70KObxDDCOn8AA==
Age: 45171
GET

https://sos.adaware.com/v1/offer/detail?_id=dbd004e0057c583d45a95f18ed713e7ef45ef93e

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=dbd004e0057c583d45a95f18ed713e7ef45ef93e HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:00 GMT
Content-Type: application/json
Content-Length: 41861
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 13:07:10 GMT
Expires: Thu, 17 Aug 2023 15:24:00 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82bff1d8c10e84-AMS
GET

https://sos.adaware.com/v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:02 GMT
Content-Type: application/json
Content-Length: 27670
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 12:58:59 GMT
Expires: Thu, 17 Aug 2023 15:24:02 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82bffe4c720e84-AMS
DNS

download.winzip.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

download.winzip.com

IN A

Response

download.winzip.com

IN CNAME

www.winzip1.com.edgekey.net

www.winzip1.com.edgekey.net

IN CNAME

e94167.b.akamaiedge.net

e94167.b.akamaiedge.net

IN A

2.19.195.232

e94167.b.akamaiedge.net

IN A

2.19.195.193
HEAD

https://download.winzip.com/nkln/27/winzip_mul_64.msi

setup94351.exe

Remote address:

2.19.195.232:443

Request

HEAD /nkln/27/winzip_mul_64.msi HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.winzip.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Length: 216237056
Content-Type: text/plain
ETag: "d92453bc245cf1f8482aaf96a85d5280:1661296616.331573"
Last-Modified: Tue, 23 Aug 2022 23:17:20 GMT
Server: AkamaiNetStorage
Date: Thu, 17 Aug 2023 14:54:00 GMT
Connection: keep-alive
HEAD

https://download.winzip.com/nkln/27/winzip_mul_64.msi

setup94351.exe

Remote address:

2.19.195.232:443

Request

HEAD /nkln/27/winzip_mul_64.msi HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.winzip.com

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Length: 216237056
Content-Type: text/plain
ETag: "d92453bc245cf1f8482aaf96a85d5280:1661296616.331573"
Last-Modified: Tue, 23 Aug 2022 23:17:20 GMT
Server: AkamaiNetStorage
Date: Thu, 17 Aug 2023 14:54:00 GMT
Connection: keep-alive
DNS

download.enigmasoftware.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

download.enigmasoftware.com

IN A

Response

download.enigmasoftware.com

IN A

18.65.39.106

download.enigmasoftware.com

IN A

18.65.39.113

download.enigmasoftware.com

IN A

18.65.39.95

download.enigmasoftware.com

IN A

18.65.39.4
HEAD

https://download.enigmasoftware.com/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

setup94351.exe

Remote address:

18.65.39.106:443

Request

HEAD /spyhunter-free-download/silent/lav/SpyHunter-Installer.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.enigmasoftware.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Length: 0
Connection: keep-alive
Date: Thu, 17 Aug 2023 10:30:28 GMT
Location: https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe
Server: AmazonS3
X-Cache: Hit from cloudfront
Via: 1.1 1a89beee9d72657437f5e91f57220804.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: AMS1-P1
X-Amz-Cf-Id: jIm8mnRfbJn5F1CStybPH-vQ425Jt6axsS04S5NlU4USN5vwZmDYuQ==
Age: 15813
DNS

spyhunter-download-v2.b-cdn.net

setup94351.exe

Remote address:

8.8.8.8:53

Request

spyhunter-download-v2.b-cdn.net

IN A

Response

spyhunter-download-v2.b-cdn.net

IN A

103.180.115.13
DNS

92.139.222.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

92.139.222.52.in-addr.arpa

IN PTR

Response

92.139.222.52.in-addr.arpa

IN PTR

server-52-222-139-92ams50r cloudfrontnet
DNS

232.195.19.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.195.19.2.in-addr.arpa

IN PTR

Response

232.195.19.2.in-addr.arpa

IN PTR

a2-19-195-232deploystaticakamaitechnologiescom
HEAD

https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

setup94351.exe

Remote address:

103.180.115.13:443

Request

HEAD /spyhunter-free-download/silent/lav/SpyHunter-Installer.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: spyhunter-download-v2.b-cdn.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:01 GMT
Content-Type: application/octet-stream
Content-Length: 6893544
Connection: keep-alive
Server: BunnyCDN-CEN1-1045
CDN-PullZone: 1053841
CDN-Uid: 27a71848-22f2-45db-b801-7c7517de9523
CDN-RequestCountryCode: IN
Cache-Control: public, max-age=2592000
ETag: "c63e20841fed7e3fef9c88f91d8ad413"
Last-Modified: Thu, 02 Mar 2023 16:40:50 GMT
x-amz-id-2: 0w8CHQqsNCdvxpuxRncLuJ7zhI22Q3FylWsFQAnDQ45dXFNOvSaOkVR14+4J6ZLs30uNeTdi6N8=
x-amz-request-id: J76YCR1EHYX5N9A6
x-amz-server-side-encryption: AES256
x-amz-meta-cb-modifiedtime: Wed, 01 Mar 2023 16:20:29 GMT
CDN-ProxyVer: 1.03
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 200
CDN-CachedAt: 06/27/2023 06:05:50
CDN-EdgeStorageId: 1045
CDN-Status: 200
CDN-RequestId: 9f06b4d0aadacceb2c3cb7ce5f3b1a71
CDN-Cache: HIT
Accept-Ranges: bytes
HEAD

https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

setup94351.exe

Remote address:

103.180.115.13:443

Request

HEAD /spyhunter-free-download/silent/lav/SpyHunter-Installer.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: spyhunter-download-v2.b-cdn.net

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:01 GMT
Content-Type: application/octet-stream
Content-Length: 6893544
Connection: keep-alive
Server: BunnyCDN-CEN1-1045
CDN-PullZone: 1053841
CDN-Uid: 27a71848-22f2-45db-b801-7c7517de9523
CDN-RequestCountryCode: IN
Cache-Control: public, max-age=2592000
ETag: "c63e20841fed7e3fef9c88f91d8ad413"
Last-Modified: Thu, 02 Mar 2023 16:40:50 GMT
x-amz-id-2: 0w8CHQqsNCdvxpuxRncLuJ7zhI22Q3FylWsFQAnDQ45dXFNOvSaOkVR14+4J6ZLs30uNeTdi6N8=
x-amz-request-id: J76YCR1EHYX5N9A6
x-amz-server-side-encryption: AES256
x-amz-meta-cb-modifiedtime: Wed, 01 Mar 2023 16:20:29 GMT
CDN-ProxyVer: 1.03
CDN-RequestPullSuccess: True
CDN-RequestPullCode: 200
CDN-CachedAt: 06/27/2023 06:05:50
CDN-EdgeStorageId: 1045
CDN-Status: 200
CDN-RequestId: 4b6aa240680afb077df51118dd2f0f39
CDN-Cache: HIT
Accept-Ranges: bytes
DNS

cdn-download.avgbrowser.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

cdn-download.avgbrowser.com

IN A

Response

cdn-download.avgbrowser.com

IN CNAME

cdn-prod-download.browser.akamaized.net

cdn-prod-download.browser.akamaized.net

IN CNAME

a333.dscd.akamai.net

a333.dscd.akamai.net

IN A

88.221.135.209

a333.dscd.akamai.net

IN A

88.221.134.51
DNS

cdn-download.avgbrowser.com

setup94351.exe

Remote address:

8.8.8.8:53

Request

cdn-download.avgbrowser.com

IN A

Response

cdn-download.avgbrowser.com

IN CNAME

cdn-prod-download.browser.akamaized.net

cdn-prod-download.browser.akamaized.net

IN CNAME

a333.dscd.akamai.net

a333.dscd.akamai.net

IN A

88.221.135.209

a333.dscd.akamai.net

IN A

88.221.134.51
DNS

106.39.65.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

106.39.65.18.in-addr.arpa

IN PTR

Response

106.39.65.18.in-addr.arpa

IN PTR

server-18-65-39-106ams1r cloudfrontnet
HEAD

https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

setup94351.exe

Remote address:

88.221.135.209:443

Request

HEAD /avg_secure_browser_setup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: cdn-download.avgbrowser.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: application/octet-stream
Content-Length: 6246416
Pragma: public
content-disposition: attachment; filename="avg_secure_browser_setup.exe"
Last-Modified: Tue, 06 Jun 2023 12:57:01 GMT
ETag: b019a44edace07b3200d1d70ccbfc8b5
Accept-Ranges: bytes
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f824fb1682bdd27-LHR
Cache-Control: public, must-revalidate, max-age=0, post-check=0, pre-check=0
Expires: Thu, 17 Aug 2023 14:54:01 GMT
Date: Thu, 17 Aug 2023 14:54:01 GMT
Connection: keep-alive
HEAD

https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

setup94351.exe

Remote address:

88.221.135.209:443

Request

HEAD /avg_secure_browser_setup.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: cdn-download.avgbrowser.com

Response

HTTP/1.1 200 OK

Content-Type: application/octet-stream
Content-Length: 6246416
Pragma: public
content-disposition: attachment; filename="avg_secure_browser_setup.exe"
Last-Modified: Tue, 06 Jun 2023 12:57:01 GMT
ETag: b019a44edace07b3200d1d70ccbfc8b5
Accept-Ranges: bytes
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7f824fb1682bdd27-LHR
Cache-Control: public, must-revalidate, max-age=0, post-check=0, pre-check=0
Expires: Thu, 17 Aug 2023 14:54:01 GMT
Date: Thu, 17 Aug 2023 14:54:01 GMT
Connection: keep-alive
DNS

bits.avcdn.net

setup94351.exe

Remote address:

8.8.8.8:53

Request

bits.avcdn.net

IN A

Response

bits.avcdn.net

IN CNAME

bits.avast.com-v1.edgekey.net

bits.avast.com-v1.edgekey.net

IN CNAME

e4682.dscd.akamaiedge.net

e4682.dscd.akamaiedge.net

IN A

23.222.18.2
HEAD

https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

setup94351.exe

Remote address:

23.222.18.2:443

Request

HEAD /platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 263576
Last-Modified: Sat, 12 Aug 2023 05:42:59 GMT
ETag: "64d71be3-40598"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="avast_free_antivirus_setup_online.exe"
Date: Thu, 17 Aug 2023 14:54:02 GMT
Connection: keep-alive
HEAD

https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

setup94351.exe

Remote address:

23.222.18.2:443

Request

HEAD /platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 263576
Last-Modified: Sat, 12 Aug 2023 05:42:59 GMT
ETag: "64d71be3-40598"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="avast_free_antivirus_setup_online.exe"
Date: Thu, 17 Aug 2023 14:54:02 GMT
Connection: keep-alive
GET

https://sos.adaware.com/v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823

setup94351.exe

Remote address:

104.18.68.73:443

Request

GET /v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823 HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Referer: https://www.adaware.com
installid: cfa8df0d-f95c-48b5-afdf-99b8bc06ca00
Host: sos.adaware.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:02 GMT
Content-Type: application/json
Content-Length: 818083
Connection: keep-alive
CF-Cache-Status: EXPIRED
Last-Modified: Thu, 17 Aug 2023 11:23:19 GMT
Expires: Thu, 17 Aug 2023 15:24:02 GMT
Cache-Control: public, max-age=1800
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 7f82bffffb620b89-AMS
HEAD

https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

setup94351.exe

Remote address:

23.222.18.2:443

Request

HEAD /productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 50681544
Last-Modified: Wed, 16 Aug 2023 10:59:08 GMT
ETag: "64dcabfc-30556c8"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="ccsetup615_slim.exe"
Date: Thu, 17 Aug 2023 14:54:02 GMT
Connection: keep-alive
HEAD

https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

setup94351.exe

Remote address:

23.222.18.2:443

Request

HEAD /productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: bits.avcdn.net

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: application/octet-stream
Content-Length: 50681544
Last-Modified: Wed, 16 Aug 2023 10:59:08 GMT
ETag: "64dcabfc-30556c8"
Accept-Ranges: bytes
Content-Disposition: attachment; filename="ccsetup615_slim.exe"
Date: Thu, 17 Aug 2023 14:54:02 GMT
Connection: keep-alive
DNS

2.18.222.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.18.222.23.in-addr.arpa

IN PTR

Response

2.18.222.23.in-addr.arpa

IN PTR

a23-222-18-2deploystaticakamaitechnologiescom
DNS

2.18.222.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.18.222.23.in-addr.arpa

IN PTR

Response

2.18.222.23.in-addr.arpa

IN PTR

a23-222-18-2deploystaticakamaitechnologiescom
DNS

setup94351.exe

Remote address:

198.72.111.246:443

Response

HTTP/1.0 400 Bad request

Cache-Control: no-cache
Connection: close
Content-Type: text/html
HEAD

http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

setup94351.exe

Remote address:

50.62.141.182:80

Request

HEAD /terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.terabyteunlimited.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:04 GMT
Server: Apache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Last-Modified: Thu, 13 Jul 2023 02:24:37 GMT
ETag: "3f01a8e-b53d088-6005508a21a01"
Accept-Ranges: bytes
Content-Length: 190042248
Vary: Accept-Encoding
Keep-Alive: timeout=5
Content-Type: application/x-msdownload
HEAD

http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

setup94351.exe

Remote address:

50.62.141.182:80

Request

HEAD /terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe HTTP/1.1
User-Agent: .NET Framework (Microsoft Windows NT 10.0.19041.0; x64; H2O/7.14.2.0)
Host: download.terabyteunlimited.com

Response

HTTP/1.1 200 OK

Date: Thu, 17 Aug 2023 14:54:04 GMT
Server: Apache
Last-Modified: Thu, 13 Jul 2023 02:24:37 GMT
ETag: "3f01a8e-b53d088-6005508a21a01"
Accept-Ranges: bytes
Content-Length: 190042248
Vary: Accept-Encoding
Content-Type: application/x-msdownload
DNS

254.111.26.67.in-addr.arpa

Remote address:

8.8.8.8:53

Request

254.111.26.67.in-addr.arpa

IN PTR

Response
DNS

68.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.32.126.40.in-addr.arpa

IN PTR

Response
DNS

208.194.73.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

208.194.73.20.in-addr.arpa

IN PTR

Response
DNS

25.63.96.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

25.63.96.20.in-addr.arpa

IN PTR

Response
DNS

67.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.31.126.40.in-addr.arpa

IN PTR

Response
DNS

11.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

11.227.111.52.in-addr.arpa

IN PTR

Response
DNS

1.208.79.178.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.208.79.178.in-addr.arpa

IN PTR

Response

1.208.79.178.in-addr.arpa

IN PTR

https-178-79-208-1amsllnwnet

188.114.97.0:443

https://filedm.com/assets/img/brand/favicon.png

tls, http2

msedge.exe

10.2kB
348.4kB
167
290

HTTP Request

GET https://filedm.com/s9C5b

HTTP Response

200

HTTP Request

GET https://filedm.com/assets/libs/@fortawesome/fontawesome-free/css/all.min.css

HTTP Request

GET https://filedm.com/assets/css/quick-website.css

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://filedm.com/assets/libs/jquery/dist/jquery.min.js

HTTP Request

GET https://filedm.com/assets/libs/bootstrap/dist/js/bootstrap.bundle.min.js

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://filedm.com/assets/libs/svg-injector/dist/svg-injector.min.js

HTTP Response

200

HTTP Request

GET https://filedm.com/assets/libs/feather-icons/dist/feather.min.js

HTTP Response

200

HTTP Request

GET https://filedm.com/assets/js/quick-website.js

HTTP Request

GET https://filedm.com/assets/img/brand/logo.png

HTTP Request

GET https://filedm.com/assets/img/brand/win.png

HTTP Request

GET https://filedm.com/assets/img/brand/marker_1.png

HTTP Request

GET https://filedm.com/assets/img/next.png

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://filedm.com/assets/libs/@fortawesome/fontawesome-free/webfonts/fa-solid-900.woff2

HTTP Response

200

HTTP Request

GET https://filedm.com/assets/img/brand/favicon.png

HTTP Response

200
88.221.25.153:80

http://apps.identrust.com/roots/dstrootcax3.p7c

http

msedge.exe

416 B
1.7kB
6
5

HTTP Request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

HTTP Response

200
142.250.179.162:443

https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x83a45f8a812f61710000000000000000%22,%222%22:%220x626a10b0306c7c020000000000000000%22,%225%22:%220x5a653054eef95e2c0000000000000000%22},%22debug_key%22:%222597011442594639183%22,%22debug_reporting%22:true,%22destination%22:%22https://grammarly.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22956476927%22],%224%22:[%2208-17%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211580217851216142337%22}&andc=true

tls, http2

msedge.exe

2.9kB
12.1kB
21
23

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/html/r20230815/r20190131/zrt_lookup.html

HTTP Request

OPTIONS https://www.googleadservices.com/pagead/ar-adview/?nrh={%22aggregation_keys%22:{%221%22:%220x83a45f8a812f61710000000000000000%22,%222%22:%220x626a10b0306c7c020000000000000000%22,%225%22:%220x5a653054eef95e2c0000000000000000%22},%22debug_key%22:%222597011442594639183%22,%22debug_reporting%22:true,%22destination%22:%22https://grammarly.com%22,%22event_report_window%22:%22259200%22,%22expiry%22:%222592000%22,%22filter_data%22:{%222%22:[%22956476927%22],%224%22:[%2208-17%22],%226%22:[%22true%22]},%22priority%22:%22500%22,%22source_event_id%22:%2211580217851216142337%22}&andc=true
142.251.36.2:443

https://partner.googleadservices.com/gampad/cookie.js?domain=filedm.com&callback=_gfp_s_&client=ca-pub-5249810785570428

tls, http2

msedge.exe

1.9kB
7.2kB
17
18

HTTP Request

GET https://partner.googleadservices.com/gampad/cookie.js?domain=filedm.com&callback=_gfp_s_&client=ca-pub-5249810785570428
142.251.36.1:443

tpc.googlesyndication.com

tls, http2

msedge.exe

999 B
5.8kB
9
8
142.251.36.1:443

tpc.googlesyndication.com

tls, http2

msedge.exe

999 B
5.8kB
9
8
142.251.36.1:443

tpc.googlesyndication.com

tls, http2

msedge.exe

999 B
5.8kB
9
8
142.251.36.1:443

tpc.googlesyndication.com

tls, http2

msedge.exe

999 B
5.8kB
9
8
142.251.36.1:443

https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/window_focus_fy2021.js

tls, http2

msedge.exe

3.9kB
57.0kB
50
53

HTTP Request

GET https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/qs_click_protection_fy2021.js

HTTP Request

GET https://tpc.googlesyndication.com/simgad/5812785455796822292/14763004658117789537?w=600&h=314

HTTP Request

GET https://tpc.googlesyndication.com/simgad/2984971332974739170?w=100&h=100

HTTP Request

GET https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/load_preloaded_resource_fy2021.js

HTTP Request

GET https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/abg_lite_fy2021.js

HTTP Request

GET https://tpc.googlesyndication.com/pagead/js/r20230815/r20110914/client/window_focus_fy2021.js
142.251.36.1:443

tpc.googlesyndication.com

tls, http2

msedge.exe

999 B
5.8kB
9
8
142.251.36.34:443

https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914

tls, http2

msedge.exe

3.3kB
67.9kB
48
58

HTTP Request

GET https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
172.217.23.195:443

https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html

tls, http2

msedge.exe

2.0kB
7.6kB
17
17

HTTP Request

GET https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com/v6exp3/redir.html
104.21.68.145:443

https://freefiledl.com/?id=Synapse%20X%20Free%20-%20UWP%202.598_94351

tls, http2

msedge.exe

172.0kB
10.2MB
3711
7333

HTTP Request

GET https://freefiledl.com/?id=Synapse%20X%20Free%20-%20UWP%202.598_94351

HTTP Response

200
104.21.68.145:443

freefiledl.com

tls

msedge.exe

943 B
4.6kB
8
7
142.251.39.114:443

https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i1-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif

tls, http2

msedge.exe

2.0kB
7.4kB
18
17

HTTP Request

GET https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i1-v6exp3.v4.metric.gstatic.com/v6exp3/6.gif
142.250.179.146:443

https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i2-v6exp3.ds.metric.gstatic.com/v6exp3/6.gif

tls, http2

msedge.exe

2.0kB
6.9kB
17
16

HTTP Request

GET https://p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i2-v6exp3.ds.metric.gstatic.com/v6exp3/6.gif
35.190.60.70:443

www.dlsft.com

tls

Synapse X Free - UWP 2.598_94351.exe

594 B
4.9kB
9
7
35.190.60.70:443

www.dlsft.com

tls

Synapse X Free - UWP 2.598_94351.exe

594 B
4.9kB
9
7
35.190.60.70:443

www.dlsft.com

tls

Synapse X Free - UWP 2.598_94351.exe

594 B
4.9kB
9
7
35.190.60.70:443

www.dlsft.com

tls

Synapse X Free - UWP 2.598_94351.exe

594 B
4.9kB
9
7
35.190.60.70:80

http://dlsft.com/callback/offers.php

http

Synapse X Free - UWP 2.598_94351.exe

681 B
856 B
7
5

HTTP Request

GET http://dlsft.com/callback/info.php?id=94351

HTTP Response

200

HTTP Request

GET http://dlsft.com/callback/offers.php

HTTP Response

200
35.190.60.70:80

http://dlsft.com/callback/?channel=s9C5b&id=94351&action=completed

http

Synapse X Free - UWP 2.598_94351.exe

1.3kB
752 B
9
7

HTTP Request

POST http://dlsft.com/callback/geo/geo.php

HTTP Response

200

HTTP Request

POST http://dlsft.com/callback/?channel=s9C5b&id=94351&action=started

HTTP Response

200

HTTP Request

POST http://dlsft.com/callback/?channel=s9C5b&id=94351&action=completed

HTTP Response

200
188.114.96.0:443

filedm.com

tls

Synapse X Free - UWP 2.598_94351.exe

591 B
5.0kB
9
7
35.190.60.70:80

http://dlsft.com/callback/geo/geo.php

http

Synapse X Free - UWP 2.598_94351.exe

518 B
298 B
5
3

HTTP Request

POST http://dlsft.com/callback/geo/geo.php

HTTP Response

200
188.114.96.0:443

filedm.com

tls

Synapse X Free - UWP 2.598_94351.exe

591 B
5.0kB
9
7
35.190.60.70:80

http://dlsft.com/callback/?channel=s9C5b&id=94351&action=completed

http

Synapse X Free - UWP 2.598_94351.exe

948 B
506 B
7
5

HTTP Request

POST http://dlsft.com/callback/?channel=s9C5b&id=94351&action=started

HTTP Response

200

HTTP Request

POST http://dlsft.com/callback/?channel=s9C5b&id=94351&action=completed

HTTP Response

200
23.222.33.142:80

http://x2.c.lencr.org/

http

Synapse X Free - UWP 2.598_94351.exe

397 B
773 B
6
4

HTTP Request

GET http://x2.c.lencr.org/

HTTP Response

200
23.222.33.142:80

http://x2.c.lencr.org/

http

Synapse X Free - UWP 2.598_94351.exe

345 B
721 B
5
3

HTTP Request

GET http://x2.c.lencr.org/

HTTP Response

200
104.17.9.52:443

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=InstallCancel

tls, http

setup94351.exe

75.6kB
26.3kB
130
143

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleInstallStart

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleProposedOffers

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOffersApproved

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferPageShowDelay

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferCancel

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=InstallCancel

HTTP Response

200
104.17.9.52:443

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

tls, http

setup94351.exe

78.2kB
25.4kB
129
137

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleInstallStart

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleProposedOffers

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOffersApproved

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferPageShowDelay

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PostbackRequest

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200
104.18.68.73:443

https://sos.adaware.com/v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df

tls, http

setup94351.exe

14.2kB
647.6kB
263
501

HTTP Request

POST https://sos.adaware.com/v1/bundle/list?bundleId=DT001

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=6fbc973ae45295355324b69cee87937bc4057e68

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=dbd004e0057c583d45a95f18ed713e7ef45ef93e

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df

HTTP Response

200
104.18.68.73:443

https://sos.adaware.com/v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df

tls, http

setup94351.exe

14.1kB
647.4kB
260
495

HTTP Request

POST https://sos.adaware.com/v1/bundle/list?bundleId=DT001

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=6fbc973ae45295355324b69cee87937bc4057e68

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=dbd004e0057c583d45a95f18ed713e7ef45ef93e

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df

HTTP Response

200
104.18.68.73:443

https://sos.adaware.com/v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823

tls, http

setup94351.exe

19.6kB
1.0MB
386
750

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=574e67ffa35da5479ff8e7d0a60990fb5dedbf5c

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=ed9a2bc53ed0784001f05338acad53468e3c9a92

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=ae1ec72a95b1edba3c28eabe896ef521ee41a67e

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823

HTTP Response

200
104.18.68.73:443

https://sos.adaware.com/v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823

tls, http

setup94351.exe

19.5kB
1.0MB
384
749

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=574e67ffa35da5479ff8e7d0a60990fb5dedbf5c

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=ed9a2bc53ed0784001f05338acad53468e3c9a92

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=ae1ec72a95b1edba3c28eabe896ef521ee41a67e

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823

HTTP Response

200
52.222.139.89:443

https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

tls, http

setup94351.exe

1.2kB
7.2kB
11
14

HTTP Request

HEAD https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

HTTP Response

200

HTTP Request

HEAD https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

HTTP Response

200
52.222.139.89:443

https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

tls, http

setup94351.exe

1.2kB
7.2kB
10
14

HTTP Request

HEAD https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

HTTP Response

200

HTTP Request

HEAD https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

HTTP Response

200
185.26.182.112:443

https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

tls, http

setup94351.exe

1.2kB
3.7kB
9
9

HTTP Request

HEAD https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

HTTP Response

200

HTTP Request

HEAD https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

HTTP Response

200
185.26.182.112:443

https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

tls, http

setup94351.exe

1.2kB
3.7kB
9
9

HTTP Request

HEAD https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

HTTP Response

200

HTTP Request

HEAD https://net.geo.opera.com/opera/stable/windows?utm_source=LAVASOFT&utm_medium=apb&utm_campaign=lavasoftACCDEC

HTTP Response

200
2.19.195.193:443

https://download.winzip.com/nkln/27/winzip_mul_64.msi

tls, http

setup94351.exe

1.2kB
6.4kB
11
15

HTTP Request

HEAD https://download.winzip.com/nkln/27/winzip_mul_64.msi

HTTP Response

200

HTTP Request

HEAD https://download.winzip.com/nkln/27/winzip_mul_64.msi

HTTP Response

200
2.19.195.193:443

https://download.winzip.com/nkln/27/winzip_mul_64.msi

tls, http

setup94351.exe

1.2kB
6.4kB
11
15

HTTP Request

HEAD https://download.winzip.com/nkln/27/winzip_mul_64.msi

HTTP Response

200

HTTP Request

HEAD https://download.winzip.com/nkln/27/winzip_mul_64.msi

HTTP Response

200
104.18.68.73:443

https://sos.adaware.com/v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f

tls, http

setup94351.exe

2.0kB
55.1kB
27
47

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f

HTTP Response

200
104.18.68.73:443

https://sos.adaware.com/v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f

tls, http

setup94351.exe

2.0kB
55.2kB
28
50

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f

HTTP Response

200
23.206.85.138:443

https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

tls, http

setup94351.exe

1.2kB
5.1kB
10
13

HTTP Request

HEAD https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

HTTP Response

200

HTTP Request

HEAD https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

HTTP Response

200
18.65.39.95:443

https://download.enigmasoftware.com/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

tls, http

setup94351.exe

932 B
6.4kB
9
9

HTTP Request

HEAD https://download.enigmasoftware.com/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

HTTP Response

301
18.65.39.95:443

https://download.enigmasoftware.com/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

tls, http

setup94351.exe

932 B
6.4kB
9
9

HTTP Request

HEAD https://download.enigmasoftware.com/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

HTTP Response

301
103.180.115.13:443

https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

tls, http

setup94351.exe

1.2kB
7.5kB
10
11

HTTP Request

HEAD https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

HTTP Response

200

HTTP Request

HEAD https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

HTTP Response

200
103.180.115.13:443

https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

tls, http

setup94351.exe

1.2kB
7.5kB
10
11

HTTP Request

HEAD https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

HTTP Response

200

HTTP Request

HEAD https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

HTTP Response

200
88.221.135.209:443

https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

tls, http

setup94351.exe

1.2kB
7.3kB
11
15

HTTP Request

HEAD https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

HTTP Response

200

HTTP Request

HEAD https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

HTTP Response

200
88.221.135.209:443

https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

tls, http

setup94351.exe

1.2kB
7.3kB
11
15

HTTP Request

HEAD https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

HTTP Response

200

HTTP Request

HEAD https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

HTTP Response

200
23.206.85.138:443

https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

tls, http

setup94351.exe

1.3kB
5.0kB
10
13

HTTP Request

HEAD https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

HTTP Response

200

HTTP Request

HEAD https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

HTTP Response

200
23.206.85.138:443

https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

tls, http

setup94351.exe

1.2kB
5.1kB
10
13

HTTP Request

HEAD https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

HTTP Response

200

HTTP Request

HEAD https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

HTTP Response

200
198.72.111.246:443

download2021.pdf-suite.com

tls, http

setup94351.exe

689 B
4.1kB
9
11

HTTP Response

400
23.206.85.138:443

https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

tls, http

setup94351.exe

1.3kB
5.0kB
10
13

HTTP Request

HEAD https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

HTTP Response

200

HTTP Request

HEAD https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

HTTP Response

200
198.72.111.246:443

download2021.pdf-suite.com

tls, http

setup94351.exe

735 B
4.1kB
10
11

HTTP Response

400
198.72.111.246:443

download2021.pdf-suite.com

tls

setup94351.exe

610 B
321 B
5
5
198.72.111.246:443

download2021.pdf-suite.com

tls

setup94351.exe

610 B
321 B
5
5
50.62.141.182:80

http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

http

setup94351.exe

698 B
823 B
6
5

HTTP Request

HEAD http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

HTTP Response

200

HTTP Request

HEAD http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

HTTP Response

200
50.62.141.182:80

http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

http

setup94351.exe

698 B
823 B
6
5

HTTP Request

HEAD http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

HTTP Response

200

HTTP Request

HEAD http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

HTTP Response

200
216.58.214.3:443

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-s1-v6exp3-v4.metric.gstatic.com

tls

msedge.exe

909 B
4.9kB
8
8
104.17.9.52:443

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleInstallComplete

tls, http

OfferInstaller.exe

9.5kB
9.7kB
33
41

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDeclined

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDeclined

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDeclined

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleInstallComplete

HTTP Response

200
167.235.218.62:80

http://a.directfiledl.com/getfile?id=94351

http

msedge.exe

149.7kB
9.0MB
3244
6436

HTTP Request

GET http://a.directfiledl.com/getfile?id=94351

HTTP Response

200
167.235.218.62:80

a.directfiledl.com

http

msedge.exe

236 B
339 B
5
3

HTTP Response

400
35.190.60.70:443

www.dlsft.com

tls

Synapse X Free - UWP 2.598_94351.exe

594 B
4.9kB
9
7
35.190.60.70:443

www.dlsft.com

tls

Synapse X Free - UWP 2.598_94351.exe

594 B
4.9kB
9
7
104.17.9.52:443

https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOffersApproved

tls, http

setup94351.exe

54.4kB
17.0kB
87
92

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleInstallStart

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=PageShown

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleProposedOffers

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOfferRejected

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=OfferDetailsReceived

HTTP Response

200

HTTP Request

POST https://flow.lavasoft.com/v1/event-stat/?ProductID=IS&Type=BundleOffersApproved

HTTP Response

200
104.18.68.73:443

https://sos.adaware.com/v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df

tls, http

setup94351.exe

13.9kB
463.7kB
225
373

HTTP Request

POST https://sos.adaware.com/v1/bundle/list?bundleId=DT001

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=574e67ffa35da5479ff8e7d0a60990fb5dedbf5c

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=ed9a2bc53ed0784001f05338acad53468e3c9a92

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=ae1ec72a95b1edba3c28eabe896ef521ee41a67e

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=ef5b479d741ad9a2cd4200a0061d96416809857f

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=98fb803d820deca6339be22b78181f5f0296f5df

HTTP Response

200
35.190.60.70:80

http://dlsft.com/callback/geo/geo.php

http

Synapse X Free - UWP 2.598_94351.exe

783 B
543 B
7
5

HTTP Request

GET http://dlsft.com/callback/offers.php

HTTP Response

200

HTTP Request

POST http://dlsft.com/callback/geo/geo.php

HTTP Response

200
35.190.60.70:80

http://dlsft.com/callback/?channel=s9C5b&id=94351&action=started

http

Synapse X Free - UWP 2.598_94351.exe

817 B
838 B
7
5

HTTP Request

GET http://dlsft.com/callback/info.php?id=94351

HTTP Response

200

HTTP Request

POST http://dlsft.com/callback/?channel=s9C5b&id=94351&action=started

HTTP Response

200
188.114.96.0:443

filedm.com

tls

Synapse X Free - UWP 2.598_94351.exe

591 B
5.0kB
9
7
52.222.139.92:443

https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

tls, http

setup94351.exe

1.2kB
7.2kB
10
14

HTTP Request

HEAD https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

HTTP Response

200

HTTP Request

HEAD https://webcf.quickdriverupdater.com/win/qdu/builds/v1013/qdurtsetup.exe

HTTP Response

200
104.18.68.73:443

https://sos.adaware.com/v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac

tls, http

setup94351.exe

2.7kB
74.3kB
37
65

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=dbd004e0057c583d45a95f18ed713e7ef45ef93e

HTTP Response

200

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=56621ee5291c50b312a5debbfaa90ea4e3191aac

HTTP Response

200
2.19.195.232:443

https://download.winzip.com/nkln/27/winzip_mul_64.msi

tls, http

setup94351.exe

1.2kB
6.4kB
11
15

HTTP Request

HEAD https://download.winzip.com/nkln/27/winzip_mul_64.msi

HTTP Response

200

HTTP Request

HEAD https://download.winzip.com/nkln/27/winzip_mul_64.msi

HTTP Response

200
18.65.39.106:443

https://download.enigmasoftware.com/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

tls, http

setup94351.exe

978 B
6.5kB
10
10

HTTP Request

HEAD https://download.enigmasoftware.com/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

HTTP Response

301
103.180.115.13:443

https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

tls, http

setup94351.exe

1.2kB
7.5kB
10
11

HTTP Request

HEAD https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

HTTP Response

200

HTTP Request

HEAD https://spyhunter-download-v2.b-cdn.net/spyhunter-free-download/silent/lav/SpyHunter-Installer.exe

HTTP Response

200
88.221.135.209:443

https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

tls, http

setup94351.exe

1.2kB
7.3kB
11
15

HTTP Request

HEAD https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

HTTP Response

200

HTTP Request

HEAD https://cdn-download.avgbrowser.com/avg_secure_browser_setup.exe

HTTP Response

200
23.222.18.2:443

https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

tls, http

setup94351.exe

1.2kB
5.1kB
10
13

HTTP Request

HEAD https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

HTTP Response

200

HTTP Request

HEAD https://bits.avcdn.net/platform_WIN/productfamily_ANTIVIRUS/cookie_mmm_lvs_ppi_002_967_v

HTTP Response

200
104.18.68.73:443

https://sos.adaware.com/v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823

tls, http

setup94351.exe

16.0kB
847.8kB
332
644

HTTP Request

GET https://sos.adaware.com/v1/offer/detail?_id=c057e5025ed4aca7ac8dde484be4c02799ff6823

HTTP Response

200
23.222.18.2:443

https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

tls, http

setup94351.exe

1.3kB
5.0kB
10
13

HTTP Request

HEAD https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

HTTP Response

200

HTTP Request

HEAD https://bits.avcdn.net/productfamily_CCLEANER/insttype_SLIM/platform_WIN_PIR/installertype_ONLINE/build_RELEASE/cookie_mmm_ccl_ppi_000_007_a

HTTP Response

200
198.72.111.246:443

download2021.pdf-suite.com

tls, http

setup94351.exe

689 B
4.1kB
9
11

HTTP Response

400
198.72.111.246:443

download2021.pdf-suite.com

tls

setup94351.exe

610 B
321 B
5
5
50.62.141.182:80

http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

http

setup94351.exe

698 B
823 B
6
5

HTTP Request

HEAD http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

HTTP Response

200

HTTP Request

HEAD http://download.terabyteunlimited.com/terabyte_drive_image_backup_and_restore_suite_en_gui_trial.exe

HTTP Response

200

8.8.8.8:53

158.240.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

158.240.127.40.in-addr.arpa
8.8.8.8:53

filedm.com

dns

Synapse X Free - UWP 2.598_94351.exe

56 B
88 B
1
1

DNS Request

filedm.com

DNS Response

188.114.97.0

188.114.96.0
8.8.8.8:53

apps.identrust.com

dns

msedge.exe

64 B
165 B
1
1

DNS Request

apps.identrust.com

DNS Response

88.221.25.153

88.221.25.169
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

74.32.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

74.32.126.40.in-addr.arpa
8.8.8.8:53

0.97.114.188.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

0.97.114.188.in-addr.arpa
8.8.8.8:53

153.25.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

153.25.221.88.in-addr.arpa
8.8.8.8:53

108.211.229.192.in-addr.arpa

dns

74 B
145 B
1
1

DNS Request

108.211.229.192.in-addr.arpa
8.8.8.8:53

googleads.g.doubleclick.net

dns

msedge.exe

73 B
89 B
1
1

DNS Request

googleads.g.doubleclick.net

DNS Response

142.250.179.162
8.8.8.8:53

106.208.58.216.in-addr.arpa

dns

73 B
143 B
1
1

DNS Request

106.208.58.216.in-addr.arpa
8.8.8.8:53

131.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

131.179.250.142.in-addr.arpa
8.8.8.8:53

200.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

200.179.250.142.in-addr.arpa
8.8.8.8:53

194.23.217.172.in-addr.arpa

dns

73 B
171 B
1
1

DNS Request

194.23.217.172.in-addr.arpa
142.250.179.162:443

googleads.g.doubleclick.net

https

msedge.exe

18.6kB
128.1kB
99
142
8.8.8.8:53

partner.googleadservices.com

dns

msedge.exe

74 B
114 B
1
1

DNS Request

partner.googleadservices.com

DNS Response

142.251.36.2
8.8.8.8:53

tpc.googlesyndication.com

dns

msedge.exe

71 B
87 B
1
1

DNS Request

tpc.googlesyndication.com

DNS Response

142.251.36.1
8.8.8.8:53

www.googletagservices.com

dns

msedge.exe

71 B
87 B
1
1

DNS Request

www.googletagservices.com

DNS Response

142.251.36.34
8.8.8.8:53

206.23.217.172.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

206.23.217.172.in-addr.arpa
8.8.8.8:53

162.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

162.179.250.142.in-addr.arpa
8.8.8.8:53

2.36.251.142.in-addr.arpa

dns

71 B
109 B
1
1

DNS Request

2.36.251.142.in-addr.arpa
8.8.8.8:53

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com

dns

msedge.exe

111 B
127 B
1
1

DNS Request

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com

DNS Response

172.217.23.195
172.217.23.195:443

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-if-v6exp3-v4.metric.gstatic.com

https

msedge.exe

3.8kB
9.5kB
8
11
142.251.36.1:443

tpc.googlesyndication.com

https

msedge.exe

5.6kB
45.5kB
33
46
8.8.8.8:53

1.36.251.142.in-addr.arpa

dns

71 B
109 B
1
1

DNS Request

1.36.251.142.in-addr.arpa
8.8.8.8:53

34.36.251.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

34.36.251.142.in-addr.arpa
8.8.8.8:53

195.23.217.172.in-addr.arpa

dns

193 B
501 B
3
3

DNS Request

195.23.217.172.in-addr.arpa

DNS Request

x2.c.lencr.org

DNS Request

x2.c.lencr.org

DNS Response

23.222.33.142

DNS Response

23.222.33.142
8.8.8.8:53

196.168.217.172.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

196.168.217.172.in-addr.arpa
224.0.0.251:5353

564 B
9
8.8.8.8:53

59.128.231.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

59.128.231.4.in-addr.arpa
8.8.8.8:53

freefiledl.com

dns

msedge.exe

60 B
92 B
1
1

DNS Request

freefiledl.com

DNS Response

104.21.68.145

172.67.196.44
8.8.8.8:53

145.68.21.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

145.68.21.104.in-addr.arpa
8.8.8.8:53

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i1-v6exp3.v4.metric.gstatic.com

dns

msedge.exe

118 B
134 B
1
1

DNS Request

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i1-v6exp3.v4.metric.gstatic.com

DNS Response

142.251.39.114
8.8.8.8:53

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i2-v6exp3.ds.metric.gstatic.com

dns

msedge.exe

118 B
134 B
1
1

DNS Request

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-i2-v6exp3.ds.metric.gstatic.com

DNS Response

142.250.179.146
8.8.8.8:53

114.39.251.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

114.39.251.142.in-addr.arpa
8.8.8.8:53

146.179.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

146.179.250.142.in-addr.arpa
8.8.8.8:53

38.148.119.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

38.148.119.40.in-addr.arpa
8.8.8.8:53

101.14.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

101.14.18.104.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

101.15.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

101.15.18.104.in-addr.arpa
8.8.8.8:53

www.dlsft.com

dns

Synapse X Free - UWP 2.598_94351.exe

118 B
178 B
2
2

DNS Request

www.dlsft.com

DNS Response

35.190.60.70

DNS Request

www.dlsft.com

DNS Response

35.190.60.70
8.8.8.8:53

26.165.165.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

26.165.165.52.in-addr.arpa
8.8.8.8:53

70.60.190.35.in-addr.arpa

dns

71 B
122 B
1
1

DNS Request

70.60.190.35.in-addr.arpa
8.8.8.8:53

206.23.85.13.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

206.23.85.13.in-addr.arpa
8.8.8.8:53

35.36.251.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

35.36.251.142.in-addr.arpa
8.8.8.8:53

dlsft.com

dns

Synapse X Free - UWP 2.598_94351.exe

110 B
142 B
2
2

DNS Request

dlsft.com

DNS Request

dlsft.com

DNS Response

35.190.60.70

DNS Response

35.190.60.70
8.8.8.8:53

filedm.com

dns

Synapse X Free - UWP 2.598_94351.exe

112 B
176 B
2
2

DNS Request

filedm.com

DNS Request

filedm.com

DNS Response

188.114.96.0

188.114.97.0

DNS Response

188.114.96.0

188.114.97.0
8.8.8.8:53

240.81.21.72.in-addr.arpa

dns

71 B
142 B
1
1

DNS Request

240.81.21.72.in-addr.arpa
8.8.8.8:53

x2.c.lencr.org

dns

Synapse X Free - UWP 2.598_94351.exe

60 B
165 B
1
1

DNS Request

x2.c.lencr.org

DNS Response

23.222.33.142
8.8.8.8:53

0.96.114.188.in-addr.arpa

dns

142 B
266 B
2
2

DNS Request

0.96.114.188.in-addr.arpa

DNS Request

0.96.114.188.in-addr.arpa
8.8.8.8:53

142.33.222.23.in-addr.arpa

dns

144 B
274 B
2
2

DNS Request

142.33.222.23.in-addr.arpa

DNS Request

142.33.222.23.in-addr.arpa
8.8.8.8:53

41.26.24.184.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

41.26.24.184.in-addr.arpa
8.8.8.8:53

flow.lavasoft.com

dns

setup94351.exe

126 B
190 B
2
2

DNS Request

flow.lavasoft.com

DNS Response

104.17.9.52

104.17.8.52

DNS Request

flow.lavasoft.com

DNS Response

104.17.9.52

104.17.8.52
8.8.8.8:53

sos.adaware.com

dns

setup94351.exe

122 B
186 B
2
2

DNS Request

sos.adaware.com

DNS Request

sos.adaware.com

DNS Response

104.18.68.73

104.18.67.73

DNS Response

104.18.68.73

104.18.67.73
8.8.8.8:53

52.9.17.104.in-addr.arpa

dns

140 B
264 B
2
2

DNS Request

52.9.17.104.in-addr.arpa

DNS Request

52.9.17.104.in-addr.arpa
8.8.8.8:53

73.68.18.104.in-addr.arpa

dns

142 B
266 B
2
2

DNS Request

73.68.18.104.in-addr.arpa

DNS Request

73.68.18.104.in-addr.arpa
8.8.8.8:53

webcf.quickdriverupdater.com

dns

setup94351.exe

148 B
362 B
2
2

DNS Request

webcf.quickdriverupdater.com

DNS Request

webcf.quickdriverupdater.com

DNS Response

52.222.139.89

52.222.139.88

52.222.139.92

52.222.139.98

DNS Response

52.222.139.98

52.222.139.88

52.222.139.89

52.222.139.92
8.8.8.8:53

89.139.222.52.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

89.139.222.52.in-addr.arpa
8.8.8.8:53

net.geo.opera.com

dns

setup94351.exe

63 B
116 B
1
1

DNS Request

net.geo.opera.com

DNS Response

185.26.182.112

185.26.182.111
8.8.8.8:53

download.winzip.com

dns

setup94351.exe

65 B
172 B
1
1

DNS Request

download.winzip.com

DNS Response

2.19.195.193

2.19.195.232
8.8.8.8:53

bits.avcdn.net

dns

setup94351.exe

120 B
304 B
2
2

DNS Request

bits.avcdn.net

DNS Request

bits.avcdn.net

DNS Response

23.206.85.138

DNS Response

23.206.85.138
8.8.8.8:53

download.enigmasoftware.com

dns

setup94351.exe

146 B
274 B
2
2

DNS Request

download.enigmasoftware.com

DNS Request

download.enigmasoftware.com

DNS Response

18.65.39.95

18.65.39.113

18.65.39.4

18.65.39.106

DNS Response

18.65.39.95

18.65.39.113

18.65.39.4

18.65.39.106
8.8.8.8:53

spyhunter-download-v2.b-cdn.net

dns

setup94351.exe

77 B
93 B
1
1

DNS Request

spyhunter-download-v2.b-cdn.net

DNS Response

103.180.115.13
8.8.8.8:53

112.182.26.185.in-addr.arpa

dns

73 B
134 B
1
1

DNS Request

112.182.26.185.in-addr.arpa
8.8.8.8:53

193.195.19.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

193.195.19.2.in-addr.arpa
8.8.8.8:53

138.85.206.23.in-addr.arpa

dns

144 B
274 B
2
2

DNS Request

138.85.206.23.in-addr.arpa

DNS Request

138.85.206.23.in-addr.arpa
8.8.8.8:53

95.39.65.18.in-addr.arpa

dns

70 B
124 B
1
1

DNS Request

95.39.65.18.in-addr.arpa
8.8.8.8:53

cdn-download.avgbrowser.com

dns

setup94351.exe

73 B
189 B
1
1

DNS Request

cdn-download.avgbrowser.com

DNS Response

88.221.135.209

88.221.134.51
8.8.8.8:53

download2021.pdf-suite.com

dns

setup94351.exe

72 B
88 B
1
1

DNS Request

download2021.pdf-suite.com

DNS Response

198.72.111.246
8.8.8.8:53

13.115.180.103.in-addr.arpa

dns

146 B
322 B
2
2

DNS Request

13.115.180.103.in-addr.arpa

DNS Request

13.115.180.103.in-addr.arpa
8.8.8.8:53

209.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

209.135.221.88.in-addr.arpa
8.8.8.8:53

download.terabyteunlimited.com

dns

setup94351.exe

152 B
184 B
2
2

DNS Request

download.terabyteunlimited.com

DNS Request

download.terabyteunlimited.com

DNS Response

50.62.141.182

DNS Response

50.62.141.182
8.8.8.8:53

246.111.72.198.in-addr.arpa

dns

146 B
272 B
2
2

DNS Request

246.111.72.198.in-addr.arpa

DNS Request

246.111.72.198.in-addr.arpa
8.8.8.8:53

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-s1-v6exp3-v4.metric.gstatic.com

dns

msedge.exe

118 B
134 B
1
1

DNS Request

p4-htk6kc4kbhmyk-m5oiin5zrfwhyjyv-263309-s1-v6exp3-v4.metric.gstatic.com

DNS Response

216.58.214.3
8.8.8.8:53

182.141.62.50.in-addr.arpa

dns

144 B
242 B
2
2

DNS Request

182.141.62.50.in-addr.arpa

DNS Request

182.141.62.50.in-addr.arpa
8.8.8.8:53

3.214.58.216.in-addr.arpa

dns

71 B
152 B
1
1

DNS Request

3.214.58.216.in-addr.arpa
8.8.8.8:53

a.directfiledl.com

dns

msedge.exe

64 B
80 B
1
1

DNS Request

a.directfiledl.com

DNS Response

167.235.218.62
8.8.8.8:53

62.218.235.167.in-addr.arpa

dns

73 B
131 B
1
1

DNS Request

62.218.235.167.in-addr.arpa
8.8.8.8:53

webcf.quickdriverupdater.com

dns

setup94351.exe

74 B
181 B
1
1

DNS Request

webcf.quickdriverupdater.com

DNS Response

52.222.139.92

52.222.139.89

52.222.139.88

52.222.139.98
8.8.8.8:53

download.winzip.com

dns

setup94351.exe

65 B
172 B
1
1

DNS Request

download.winzip.com

DNS Response

2.19.195.232

2.19.195.193
8.8.8.8:53

download.enigmasoftware.com

dns

setup94351.exe

73 B
137 B
1
1

DNS Request

download.enigmasoftware.com

DNS Response

18.65.39.106

18.65.39.113

18.65.39.95

18.65.39.4
8.8.8.8:53

spyhunter-download-v2.b-cdn.net

dns

setup94351.exe

77 B
93 B
1
1

DNS Request

spyhunter-download-v2.b-cdn.net

DNS Response

103.180.115.13
8.8.8.8:53

92.139.222.52.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

92.139.222.52.in-addr.arpa
8.8.8.8:53

232.195.19.2.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

232.195.19.2.in-addr.arpa
8.8.8.8:53

cdn-download.avgbrowser.com

dns

setup94351.exe

146 B
378 B
2
2

DNS Request

cdn-download.avgbrowser.com

DNS Request

cdn-download.avgbrowser.com

DNS Response

88.221.135.209

88.221.134.51

DNS Response

88.221.135.209

88.221.134.51
8.8.8.8:53

106.39.65.18.in-addr.arpa

dns

71 B
126 B
1
1

DNS Request

106.39.65.18.in-addr.arpa
8.8.8.8:53

bits.avcdn.net

dns

setup94351.exe

60 B
152 B
1
1

DNS Request

bits.avcdn.net

DNS Response

23.222.18.2
8.8.8.8:53

2.18.222.23.in-addr.arpa

dns

140 B
266 B
2
2

DNS Request

2.18.222.23.in-addr.arpa

DNS Request

2.18.222.23.in-addr.arpa
8.8.8.8:53

254.111.26.67.in-addr.arpa

dns

72 B
126 B
1
1

DNS Request

254.111.26.67.in-addr.arpa
8.8.8.8:53

68.32.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

68.32.126.40.in-addr.arpa
8.8.8.8:53

208.194.73.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

208.194.73.20.in-addr.arpa
8.8.8.8:53

25.63.96.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

25.63.96.20.in-addr.arpa
8.8.8.8:53

67.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

67.31.126.40.in-addr.arpa
8.8.8.8:53

11.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

11.227.111.52.in-addr.arpa
8.8.8.8:53

1.208.79.178.in-addr.arpa

dns

71 B
116 B
1
1

DNS Request

1.208.79.178.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
bd5436470d043d7fad544a1007c5ce19

SHA1
3191f3fd532cd30d484b99d96f85d712c599c86e

SHA256
188647b7417b6145b8238eb5b811ea42278f723ab568fc89aa0b838a36f0aa4e

SHA512
6303ac1f418ae2d988da4ab62e37a88d026ddc04d50e5fe02d13b5995b516d98f6c1590cb4ffb26ef95dfdac184f6b7891df1b334bea6e041f2348c17dc9d5f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\67AEE4151C4FF26BF17261A9538D4803_AE02B7A5257C8446CD0DB659EED812F5

Filesize
471B

MD5
58b577c2f2a16a54fd20efe7946e1c0a

SHA1
ed444679a2e1bd70b31b67626b662fa00f8a83a0

SHA256
278179ff6c7685fe10d100be46df68b575a4aa5e73bf1d00b792d86e82867b36

SHA512
ff1b494fec412953a552c0fc3ab3da812af6921ed8fd658b02cf85002758d42a7606f7b963ec5b3442b2b9c9fe64c950c924e4957b18ac466825a20225deaf6f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13

Filesize
724B

MD5
27ff5ca88de13b04af3d31490d8c308e

SHA1
35e2ce253a77914301c2e8a7467f1f1660426e21

SHA256
3b4eabddc9ec51d962c222f17405506efd49d49d56efe520f26c47d69aa884a5

SHA512
e7e242a30a47d0cd5874cd6c189ba8473a50358830b59a38c414a1013a22bb533ee2402c81667ff9ad37fbc6dec15aec021a227b9f95050827aeaf73b237a53e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
4e0fe7728988209cbff8652b43a60c95

SHA1
ef233ba84b05996ff574d471b7e26f977428deca

SHA256
e625528ac144dcd468d3040bdc801b6aedface4d7b8af8ab47fc402e3d99c60b

SHA512
acc302cb6de3fd7ec58d7cfb8652c0a0834b13de495759e44bf38a18178d635ab9c0932a053353c6946d879ac2c7c6dfbe08d3d397c92d0a0d0e0f250007653a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
4e0fe7728988209cbff8652b43a60c95

SHA1
ef233ba84b05996ff574d471b7e26f977428deca

SHA256
e625528ac144dcd468d3040bdc801b6aedface4d7b8af8ab47fc402e3d99c60b

SHA512
acc302cb6de3fd7ec58d7cfb8652c0a0834b13de495759e44bf38a18178d635ab9c0932a053353c6946d879ac2c7c6dfbe08d3d397c92d0a0d0e0f250007653a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\67AEE4151C4FF26BF17261A9538D4803_AE02B7A5257C8446CD0DB659EED812F5

Filesize
442B

MD5
11c97728929266e588659123bdb366cc

SHA1
4978a084fe51da4dcb81a59b0e138b8461db5076

SHA256
7baf83df9e35a3911fb48c419acfedcd2b68d0ed4e8f5d43e121d9810376d8d3

SHA512
2e2c8803fd7f34c54bdec21cb232293cd4b9ac6af03f2b3b93507e4bd649189a4334426ff0db358e36f14fa45f697e41284d009cd8c2a4f9aef54253c6996e71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13

Filesize
392B

MD5
3214423be0f57ebaf903b684fd8fa632

SHA1
f712452dc4e6041aafa6dc790ba3bf51edc2d577

SHA256
ceab10cd9682082c5f7523bc126a8ef9e974f126102b33812c7441aeb25437b6

SHA512
601fd688d27af6c286c4880660e9bbf97ef9f487aa6b5632cad9145cf2d0109e6c0721f35a53e7c82c3b8b990d900b1ceec9bf8600d1a65e2300ad8149b17784

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13

Filesize
392B

MD5
185e15d5d25657db7bcc42d371906ec4

SHA1
2d3f9a53cfae732bd4194174399f4177b323c9bf

SHA256
d02c0f34c1cc61696fbcadfe4b347be7ca5a163b81787f3f60e692f5a5be0da0

SHA512
5310ec10da9970e6b0d721dcc23e186b31a6f99d36c683fb447808329579df372afea6d6d3627253247bb43b401c6eb0acb997db14d721391f4059a0f4a443f6

Download Submit
C:\Users\Admin\AppData\Local\Adaware\OfferInstaller.exe_Url_1hem3jux35iv1vzfopbi55gu03hcnxpl\7.14.2.0\24fnnory.newcfg

Filesize
798B

MD5
f3da41e2f01ec12a28efa662df2fa963

SHA1
9760227f497132829ec34fffec6184969043bba1

SHA256
a4544f806b5637e45e2e702c7997d0b6a52b805670a72aac518d189c3004d1c2

SHA512
ae4f56f93a2386abe8891ba5ba1cc7de166a28c6a2f3913870bed2926ac43469bbbf0b4b18acf2fce7c7f120056e36b3777aabbdf9715cc12d2159403e392e59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc99b0086d7714fd471ed4acc862ccc0

SHA1
39a3c43c97f778d67413a023d66e8e930d0e2314

SHA256
45ef01f81605bfd96126d5520c5aa0304c7fa7d5fdb3e4d5b2dd2bf84e2afd96

SHA512
c308fa3eda9235d67a506a5f058fefb9a769ec01d7b0d4f5a2397892cc4f8155301c55c1fac23bebacdd087ab3f47f1eacc9ff88eff4115a7d67aa7b1d6581a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
9e54c68557fd8e7ebf6f7cf3dbf128a9

SHA1
48041cf1cc221ce889d89da3640371b48cb91e55

SHA256
a68535d0b8ced4ec153b42766953d67169aef9eaf130d8211f49e9d77204d9bf

SHA512
6c7591cc4da255e024c047fe32910b1bb6cf2863873dcac448432d9c30c958657f51c527ee489c180537c0bc067a76b1598846c8649229b77105ce79badf5d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
e1de64cf281f6e23c817428f08ef179a

SHA1
dc9c8e6244822881a59b4e910f1dc12080d92928

SHA256
c02031a85023c2812dba32ee908081b80de431360e07de195678991d9c032606

SHA512
f644d8c94fcbdda130e7114f82abd2c1230b4bf6e3b7bebbb4e632a81c226aac188175d4fbec957ea9162a4ed30571c502a943673774f83c82adea06e175518f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
db5b08c0dda257551f160184be2ed5d0

SHA1
f9a932a1106fd36858ddbacdc3bd73ac835cdb7f

SHA256
1d87bb7308d9171a7a3cc56d4d71386bc492b757a12d3618d3cebc65b49bbe0f

SHA512
ffc955454b5c957c7fd485fc6b75b3445429f1869ec7c95a9f42827efe60515fc3ace890cb9bbe2f71fa5beda824ff5726c8b837f250696355f329b8522a46c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2aaaf15b10b4d5306d23e82256ffecab

SHA1
16193526d0170883092610938225fa3be779e4ee

SHA256
49eab287d83a05ea3e938d0bc467d0e9e410b41a3d36c905f22f95041c9f5f93

SHA512
d3bc6b3876a7abc045db6e21c0cbeb39284bd1f66333a50b892c842503fb0bb6e04c21783d9419c04047a6cc1f98ce6e9caef96f0c97b5b3f2659d21a62ce86a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e01749176b1bfad4637a901bc265e31f

SHA1
e56cd2c9e48e8cf55b050474a25d8b0c97b5f1a8

SHA256
59830f28d302ccd75f1ef366ab5f32cc7c158a76d8fcd57831de3a96d6e4c772

SHA512
b347ee38f7d3be518186bcd447469dcc586d8bb74ce7b7efc7a6c9be84b6666e075440188fdd2fc0342832f95eb37e585142339646de678b028bf2e2276b1db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
50ddfb03e2d25f10442bc31eb11a68e4

SHA1
3a45a13ea94335fafcf11d4f3e202259ed4dbe3a

SHA256
481fe38c954c27db67ae901b81f09d04361d2f96e14f522665f95aa5112c53d4

SHA512
ebf200ad902b797b73c9b1dcfde98be0585c11819cc7a25abb79e5af06d9b9f55e1882fd9a8ff9cbf427cd687902b893f016711cc9dde72317ff7a821a11d9ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0524aa68692c6ac7e8ee0c851a3fbc37

SHA1
578a73d7ce38920e20dc91688216c5d29e30e0a6

SHA256
f7d97ee144088ca592bf39a4e22f2662bf5fd482ee0426ad73c7ebf5ca3b6dd9

SHA512
a98e2608fe89eb60c4a28e5408064b19b4846651b4260c1f8f1a9908eb86ee369949daa3893d2b8d9de9d24c90d891bb1aea7311748390fb77466e0777487380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
96f00bbd6a174879c58220f95f0115f5

SHA1
d3d7f82b0bf27daf1b3903bfe050c2d05422050f

SHA256
644442e740a8c0bb20f712f6f84f5bf4a81bb29d4e9446b2832ca65618961107

SHA512
e7c5e90eb85aee7b81b9c163f618ad3789a48b256040f6f00eee7fce52c60e1ff491bf0538b9c846fb115b73163710e46a45ce056e3b41ca59d88c421502ccea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000005

Filesize
17KB

MD5
aab2532f8363e63359dbf0c31981f57f

SHA1
a21523eb85636a0455977ffe525260a1a8568043

SHA256
a6abef5f074c67b1f9fbee679151a4c705b71f054c98f720dfabdc65786d5d13

SHA512
7b3c4ce6574b36bf0d4e05bba1063798b525744fdb37b28ad6fc78456ef7d704677795ae4dd0d0eda0954d15b3776395fa931abf82dd4b64583c360dd9916f64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
d0f8d3fdd4a8b25abdd25664defff719

SHA1
8e3ca69e592e6e28214cbb6975e9fc4f88d260d9

SHA256
5f200d03cd21064eaaa00c90d35301cb8f03034c243a33abaf4ce22a0efe68ed

SHA512
6688117d86423811258af6730508f80be1c565e74eaa41aa5affbe090acbca0ca94b73a33c098e183f9e28945970e3b1fa3324fe128d2eac1c56f83848b5eb46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
ccac9ae6d35a31f551be8347e04ee0e9

SHA1
73d31beb47ef02c1da3cebd7fe843f7a1a13b0eb

SHA256
dd341517c581067e7e7b64f4981485a0ec4542e5b9c207dd69fa24caa344555c

SHA512
a791ddb990a7d37b106ca8b5bef6fa6228b1e88dbc888cc4274d5d88fe2cdcc3965f096d8881b9e4f6c8213bde7a8446fe496c273660288209fe50b085025fca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
13KB

MD5
ef2b2caa231c0970de15f5dc58fd8329

SHA1
311cdc1c3288ae84881319daf0ff96fb76c3e864

SHA256
560f0c6e1857410ba7c17a3f66cbd56eb884c9a2b49473761689f0c78066a13d

SHA512
32197d2b595d2343ecc9595685e747ca45156f88cbb12c7675be3f159eacf36e575cb8b47f6f2a2f7b0fa5a060bd86888b7eb54ac11b6fd73c2f0911f4bbac10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
0c8f17d9bb9ec454bd1d181ca9cf63d0

SHA1
2362769fda06a528b82264be4dc5f8099ce40701

SHA256
51a195eef24a732067300fff9f5301bd34fcda6d186de2b4aa6e71e833124299

SHA512
62002014334ed5b97456094a9d187700b10d180723b71456310af1ab7b1ac78cd7f7de709ebc294a00fda23ee26b3e494efc1ad475126ef67c987ca930d50828

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll

Filesize
57KB

MD5
6e001f8d0ee4f09a6673a9e8168836b6

SHA1
334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

SHA256
6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

SHA512
0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll

Filesize
57KB

MD5
6e001f8d0ee4f09a6673a9e8168836b6

SHA1
334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

SHA256
6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

SHA512
0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll

Filesize
57KB

MD5
6e001f8d0ee4f09a6673a9e8168836b6

SHA1
334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

SHA256
6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

SHA512
0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll

Filesize
57KB

MD5
6e001f8d0ee4f09a6673a9e8168836b6

SHA1
334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

SHA256
6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

SHA512
0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.LastScreen.dll

Filesize
57KB

MD5
6e001f8d0ee4f09a6673a9e8168836b6

SHA1
334ad3cf0e4e3c03415a4907b2d6cf7ba4cbcd38

SHA256
6a30f9c604c4012d1d2e1ba075213c378afb1bfcb94276de7995ed7bbf492859

SHA512
0eff2e6d3ad75abf801c2ab48b62bc93ebc5a128d2e03e507e6e5665ff9a2ab58a9d82ca71195073b971f8c473f339baffdd23694084eaaff321331b5faaecf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

Filesize
117KB

MD5
08112f27dcd8f1d779231a7a3e944cb1

SHA1
39a98a95feb1b6295ad762e22aa47854f57c226f

SHA256
11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

SHA512
afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

Filesize
117KB

MD5
08112f27dcd8f1d779231a7a3e944cb1

SHA1
39a98a95feb1b6295ad762e22aa47854f57c226f

SHA256
11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

SHA512
afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

Filesize
117KB

MD5
08112f27dcd8f1d779231a7a3e944cb1

SHA1
39a98a95feb1b6295ad762e22aa47854f57c226f

SHA256
11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

SHA512
afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

Filesize
117KB

MD5
08112f27dcd8f1d779231a7a3e944cb1

SHA1
39a98a95feb1b6295ad762e22aa47854f57c226f

SHA256
11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

SHA512
afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

Filesize
117KB

MD5
08112f27dcd8f1d779231a7a3e944cb1

SHA1
39a98a95feb1b6295ad762e22aa47854f57c226f

SHA256
11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

SHA512
afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\GenericSetup.dll

Filesize
117KB

MD5
08112f27dcd8f1d779231a7a3e944cb1

SHA1
39a98a95feb1b6295ad762e22aa47854f57c226f

SHA256
11c6a8470a3f2b2be9b8cafe5f9a0afce7303bfd02ab783a0f0ee09a184649fa

SHA512
afd0c7df58b63c7cfdbedea7169a1617f2ac4bad07347f8ed7757a25ab0719489d93272109b73a1b53e9c5997dedad8da89da7b339d30fc2573ca2f76c630ddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll

Filesize
160KB

MD5
6df226bda27d26ce4523b80dbf57a9ea

SHA1
615f9aba84856026460dc54b581711dad63da469

SHA256
17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

SHA512
988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll

Filesize
160KB

MD5
6df226bda27d26ce4523b80dbf57a9ea

SHA1
615f9aba84856026460dc54b581711dad63da469

SHA256
17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

SHA512
988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll

Filesize
160KB

MD5
6df226bda27d26ce4523b80dbf57a9ea

SHA1
615f9aba84856026460dc54b581711dad63da469

SHA256
17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

SHA512
988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll

Filesize
160KB

MD5
6df226bda27d26ce4523b80dbf57a9ea

SHA1
615f9aba84856026460dc54b581711dad63da469

SHA256
17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

SHA512
988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\H2OServices.dll

Filesize
160KB

MD5
6df226bda27d26ce4523b80dbf57a9ea

SHA1
615f9aba84856026460dc54b581711dad63da469

SHA256
17d737175d50eee97ac1c77db415fe25cc3c7a3871b65b93cc3fad63808a9abc

SHA512
988961d7a95c9883a9a1732d0b5d4443c790c38e342a9e996b072b41d2e8686389f36a249f2232cb58d72f8396c849e9cc52285f35071942bec5c3754b213dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Core.dll

Filesize
56KB

MD5
f931e960cc4ed0d2f392376525ff44db

SHA1
1895aaa8f5b8314d8a4c5938d1405775d3837109

SHA256
1c1c5330ea35f518bf85fad69dc2da1a98a4dfeadbf6ac0ba0ac7cc51bbcc870

SHA512
7fa5e582ad1bb094cbbb68b1db301dcf360e180eb58f8d726a112133277ceaa39660c6d4b3248c19a8b5767a4ae09f4597535711d789ca4f9f334a204d87ffe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\MyDownloader.Extension.dll

Filesize
168KB

MD5
28f1996059e79df241388bd9f89cf0b1

SHA1
6ad6f7cde374686a42d9c0fcebadaf00adf21c76

SHA256
c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce

SHA512
9654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dll

Filesize
133KB

MD5
8db691813a26e7d0f1db5e2f4d0d05e3

SHA1
7c7a33553dd0b50b78bf0ca6974c77088da253eb

SHA256
3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701

SHA512
d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Ninject.dll

Filesize
133KB

MD5
8db691813a26e7d0f1db5e2f4d0d05e3

SHA1
7c7a33553dd0b50b78bf0ca6974c77088da253eb

SHA256
3043a65f11ac204e65bca142ff4166d85f1b22078b126b806f1fecb2a315c701

SHA512
d02458180ec6e6eda89b5b0e387510ab2fad80f9ce57b8da548aaf85c34a59c39afaeacd1947bd5eb81bee1f6d612ca57d0b2b756d64098dfc96ca0bf2d9f62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\OfferPage.html

Filesize
1KB

MD5
9ba0a91b564e22c876e58a8a5921b528

SHA1
8eb23cab5effc0d0df63120a4dbad3cffcac6f1e

SHA256
2ad742b544e72c245f4e9c2e69f989486222477c7eb06e85d28492bd93040941

SHA512
38b5fb0f12887a619facce82779cb66e2592e5922d883b9dc4d5f9d2cb12e0f84324422cd881c948f430575febd510e948a22cd291595e3a0ba0307fce73bec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\Resources\tis\Config.tis

Filesize
291B

MD5
bf5328e51e8ab1211c509b5a65ab9972

SHA1
480dfb920e926d81bce67113576781815fbd1ea4

SHA256
98f22fb45530506548ae320c32ee4939d27017481d2ad0d784aa5516f939545b

SHA512
92bd7895c5ff8c40eecfdc2325ee5d1fb7ed86ce0ef04e8e4a65714fcf5603ea0c87b71afadb473433abb24f040ccabd960fa847b885322ad9771e304b661928

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll

Filesize
134KB

MD5
105a9e404f7ac841c46380063cc27f50

SHA1
ec27d9e1c3b546848324096283797a8644516ee3

SHA256
69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

SHA512
6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll

Filesize
134KB

MD5
105a9e404f7ac841c46380063cc27f50

SHA1
ec27d9e1c3b546848324096283797a8644516ee3

SHA256
69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

SHA512
6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll

Filesize
134KB

MD5
105a9e404f7ac841c46380063cc27f50

SHA1
ec27d9e1c3b546848324096283797a8644516ee3

SHA256
69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

SHA512
6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll

Filesize
134KB

MD5
105a9e404f7ac841c46380063cc27f50

SHA1
ec27d9e1c3b546848324096283797a8644516ee3

SHA256
69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

SHA512
6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\SciterWrapper.dll

Filesize
134KB

MD5
105a9e404f7ac841c46380063cc27f50

SHA1
ec27d9e1c3b546848324096283797a8644516ee3

SHA256
69fe749457218ec9a765f9aac74caf6d4f73084cf5175d3fd1e4f345af8b3b8b

SHA512
6990cbfc90c63962abde4fdaae321386f768be9fcf4d08bccd760d55aba85199f7a3e18bd7abe23c3a8d20ea9807cecaffb4e83237633663a8bb63dd9292d940

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.Net.dll

Filesize
101KB

MD5
83d37fb4f754c7f4e41605ec3c8608ea

SHA1
70401de8ce89f809c6e601834d48768c0d65159f

SHA256
56db33c0962b3c34cba5279d2441bc4c12f28b569eadc1b3885dd0951b2c4020

SHA512
f5f3479f485b1829bbfb7eb8087353aee569184f9c506af15c4e28bfe4f73bf2cc220d817f6dfc34b2a7a6f69453f0b71e64b79c4d500ff9a243799f68e88b9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll

Filesize
151KB

MD5
72990c7e32ee6c811ea3d2ea64523234

SHA1
a7fcbf83ec6eefb2235d40f51d0d6172d364b822

SHA256
e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3

SHA512
2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll

Filesize
151KB

MD5
72990c7e32ee6c811ea3d2ea64523234

SHA1
a7fcbf83ec6eefb2235d40f51d0d6172d364b822

SHA256
e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3

SHA512
2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll

Filesize
151KB

MD5
72990c7e32ee6c811ea3d2ea64523234

SHA1
a7fcbf83ec6eefb2235d40f51d0d6172d364b822

SHA256
e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3

SHA512
2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\ServiceHide.dll

Filesize
151KB

MD5
72990c7e32ee6c811ea3d2ea64523234

SHA1
a7fcbf83ec6eefb2235d40f51d0d6172d364b822

SHA256
e77e0b4f2762f76a3eaaadf5a3138a35ec06ece80edc4b3396de7a601f8da1b3

SHA512
2908b8c387d46b6329f027bc1e21a230e5b5c32460f8667db32746bc5f12f86927faa10866961cb2c45f6d594941f6828f9078ae7209a27053f6d11586fd2682

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\msvcp140.dll

Filesize
426KB

MD5
8ff1898897f3f4391803c7253366a87b

SHA1
9bdbeed8f75a892b6b630ef9e634667f4c620fa0

SHA256
51398691feef7ae0a876b523aec47c4a06d9a1ee62f1a0aee27de6d6191c68ad

SHA512
cb071ad55beaa541b5baf1f7d5e145f2c26fbee53e535e8c31b8f2b8df4bf7723f7bef214b670b2c3de57a4a75711dd204a940a2158939ad72f551e32da7ab03

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dll

Filesize
74KB

MD5
1a84957b6e681fca057160cd04e26b27

SHA1
8d7e4c98d1ec858db26a3540baaaa9bbf96b5bfe

SHA256
9faeaa45e8cc986af56f28350b38238b03c01c355e9564b849604b8d690919c5

SHA512
5f54c9e87f2510c56f3cf2ceeb5b5ad7711abd9f85a1ff84e74dd82d15181505e7e5428eae6ff823f1190964eb0a82a569273a4562ec4131cecfa00a9d0d02aa

Download Submit
C:\Users\Admin\AppData\Local\setup94351.exe

Filesize
3.8MB

MD5
29d3a70cec060614e1691e64162a6c1e

SHA1
ce4daf2b1d39a1a881635b393450e435bfb7f7d1

SHA256
cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72

SHA512
69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b

Download Submit
C:\Users\Admin\AppData\Local\setup94351.exe

Filesize
3.8MB

MD5
29d3a70cec060614e1691e64162a6c1e

SHA1
ce4daf2b1d39a1a881635b393450e435bfb7f7d1

SHA256
cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72

SHA512
69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b

Download Submit
C:\Users\Admin\AppData\Local\setup94351.exe

Filesize
3.8MB

MD5
29d3a70cec060614e1691e64162a6c1e

SHA1
ce4daf2b1d39a1a881635b393450e435bfb7f7d1

SHA256
cc70b093a19610e9752794d757aec9ef07ca862ea9267ec6f9cc92b2aa882c72

SHA512
69d07437714259536373872e8b086fc4548f586e389f67e50f56d343e980546f92b8a13f28c853fc1daf187261087a9dceb33769ba2031c42382742d86c60e4b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-us\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe

Filesize
9.4MB

MD5
aca1a326fcab5bb042a1b51877192e69

SHA1
1b64317b58732bff20a78e103aaec5a8883aa102

SHA256
1a721347382b9cc7415a8fd9ae1b8ca257ff4bf3fb73aae51e66bf6c4d9b5349

SHA512
69d5b5bad9f46e38f6c0098739e7e71316f933593f398137de0be88b6e5734022b2db5d7709c1f4036be609f089ae31bfaa141532a5639cd053828540f96fbc7

Download Submit
C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe

Filesize
9.4MB

MD5
aca1a326fcab5bb042a1b51877192e69

SHA1
1b64317b58732bff20a78e103aaec5a8883aa102

SHA256
1a721347382b9cc7415a8fd9ae1b8ca257ff4bf3fb73aae51e66bf6c4d9b5349

SHA512
69d5b5bad9f46e38f6c0098739e7e71316f933593f398137de0be88b6e5734022b2db5d7709c1f4036be609f089ae31bfaa141532a5639cd053828540f96fbc7

Download Submit
C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe

Filesize
9.4MB

MD5
aca1a326fcab5bb042a1b51877192e69

SHA1
1b64317b58732bff20a78e103aaec5a8883aa102

SHA256
1a721347382b9cc7415a8fd9ae1b8ca257ff4bf3fb73aae51e66bf6c4d9b5349

SHA512
69d5b5bad9f46e38f6c0098739e7e71316f933593f398137de0be88b6e5734022b2db5d7709c1f4036be609f089ae31bfaa141532a5639cd053828540f96fbc7

Download Submit
C:\Users\Admin\Downloads\Synapse X Free - UWP 2.598_94351.exe

Filesize
9.4MB

MD5
aca1a326fcab5bb042a1b51877192e69

SHA1
1b64317b58732bff20a78e103aaec5a8883aa102

SHA256
1a721347382b9cc7415a8fd9ae1b8ca257ff4bf3fb73aae51e66bf6c4d9b5349

SHA512
69d5b5bad9f46e38f6c0098739e7e71316f933593f398137de0be88b6e5734022b2db5d7709c1f4036be609f089ae31bfaa141532a5639cd053828540f96fbc7

Download Submit
C:\Users\Admin\Downloads\Synapse X UWP - v2.598.zip

Filesize
8.3MB

MD5
57cd6e32b00a0d8cdf4c21419ed5f4e1

SHA1
64bf0c8bbc10c47438a718bf05ba7699c3676307

SHA256
d7c9221a81d8c2e099861cc70d58b6033df2c12abded17235abe2c54241ee313

SHA512
aa6a03aecc471baf3467e07b18db62d738e61dc9713ca62d693e6445b0f01eb33fe4944b25dd4310c6a22fbb8b9b896ed8ba14b7e34c8e11a2c01882cbdaf052

Download Submit
memory/592-420-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/592-600-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/592-486-0x0000000006010000-0x0000000006022000-memory.dmp

Filesize
72KB

Download
memory/592-432-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/592-408-0x0000000005710000-0x0000000005724000-memory.dmp

Filesize
80KB

Download
memory/592-456-0x0000000005850000-0x000000000586A000-memory.dmp

Filesize
104KB

Download
memory/592-419-0x0000000005760000-0x0000000005784000-memory.dmp

Filesize
144KB

Download
memory/592-565-0x0000000006650000-0x0000000006672000-memory.dmp

Filesize
136KB

Download
memory/592-428-0x0000000005790000-0x00000000057B8000-memory.dmp

Filesize
160KB

Download
memory/592-570-0x00000000075C0000-0x0000000007B64000-memory.dmp

Filesize
5.6MB

Download
memory/592-573-0x0000000008130000-0x00000000086E4000-memory.dmp

Filesize
5.7MB

Download
memory/592-441-0x00000000057C0000-0x00000000057EE000-memory.dmp

Filesize
184KB

Download
memory/592-466-0x0000000005950000-0x0000000005958000-memory.dmp

Filesize
32KB

Download
memory/592-629-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/592-595-0x0000000006F80000-0x0000000006FAE000-memory.dmp

Filesize
184KB

Download
memory/592-463-0x0000000005880000-0x000000000588A000-memory.dmp

Filesize
40KB

Download
memory/592-602-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/1648-383-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-459-0x0000000005670000-0x0000000005694000-memory.dmp

Filesize
144KB

Download
memory/1648-601-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-612-0x00000000054C0000-0x00000000054D0000-memory.dmp

Filesize
64KB

Download
memory/1648-469-0x0000000005720000-0x000000000574C000-memory.dmp

Filesize
176KB

Download
memory/1648-384-0x0000000000840000-0x0000000000C18000-memory.dmp

Filesize
3.8MB

Download
memory/1648-769-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/1648-564-0x0000000006480000-0x000000000650C000-memory.dmp

Filesize
560KB

Download
memory/1648-569-0x0000000006470000-0x000000000647C000-memory.dmp

Filesize
48KB

Download
memory/1648-587-0x0000000006F00000-0x0000000006F92000-memory.dmp

Filesize
584KB

Download
memory/1648-449-0x0000000005590000-0x00000000055B8000-memory.dmp

Filesize
160KB

Download
memory/1648-452-0x0000000005600000-0x0000000005632000-memory.dmp

Filesize
200KB

Download
memory/4748-907-0x0000000005020000-0x0000000005096000-memory.dmp

Filesize
472KB

Download
memory/4748-910-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/4748-917-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/4748-916-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/4748-915-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/4748-914-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/4748-913-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/4748-912-0x0000000009410000-0x000000000941E000-memory.dmp

Filesize
56KB

Download
memory/4748-911-0x0000000009430000-0x0000000009468000-memory.dmp

Filesize
224KB

Download
memory/4748-909-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/4748-908-0x00000000091E0000-0x00000000091E8000-memory.dmp

Filesize
32KB

Download
memory/4748-906-0x0000000004CA0000-0x0000000004CB0000-memory.dmp

Filesize
64KB

Download
memory/4748-905-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/4748-904-0x0000000000340000-0x00000000003A6000-memory.dmp

Filesize
408KB

Download
memory/5256-617-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/5256-615-0x0000000000A00000-0x0000000000A0C000-memory.dmp

Filesize
48KB

Download
memory/5256-616-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/5256-638-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/5524-632-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/5524-634-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/5524-633-0x0000000005AE0000-0x0000000005AF0000-memory.dmp

Filesize
64KB

Download
memory/5744-771-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/5744-766-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/5744-700-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/6032-590-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download
memory/6032-591-0x0000000005640000-0x0000000005650000-memory.dmp

Filesize
64KB

Download
memory/6032-599-0x0000000071710000-0x0000000071EC0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response