e53b2166c423e6462319922c9bdf40a019f1ea134c34496587d66092c2018b16

Analysis

max time kernel
89s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 03:25 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5c029858cd962da7c2f06f4629901818.html
Size

432B
MD5

5c029858cd962da7c2f06f4629901818
SHA1

c3a757dbf865ade84483700c31bb6b67e8acc889
SHA256

e53b2166c423e6462319922c9bdf40a019f1ea134c34496587d66092c2018b16
SHA512

20d3481e1e7592f00ddb7876046594d901d8c08f8d6790fd4110d9c7671a5cec4660c35eb4b6535dffdbb9b43f212a3cbd320332112299327db3539e19e319a0

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 904d507e6247da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31082338"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31082338"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005d05a5489e56c74eaa6b39ab0831a11f000000000200000000001066000000010000200000005d199fa2a755ab48450f71390f865b1a399ba5871c083ed8e8a7812a3fdcbe49000000000e8000000002000020000000d3f7c4ec9cde1d7939bd1423d6fad1cab2d3969b79ab64b5625b6ebb5e9eedf42000000097395b4262c6bd36f9ff96b27e665ca906f0782de8459ee780b82d613e6fdce6400000008c6dc170ef3c3ea1f6c49bc407dd2dd5c494d8e99922f1e325801aba8fc8013a99d856c26a5ecee75c916c8621608a510f431b66edfc0df1288864b985d1c453	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005d05a5489e56c74eaa6b39ab0831a11f000000000200000000001066000000010000200000008c111dd036ebf28e9cf895467e653cf8386e99ccb01ae96e4b70a5eb35b466af000000000e8000000002000020000000b7fa484ece42208816b24e42c7b9e323fdda33f44a0ecb57ae3e612548a2471c20000000025a01d0cfe5a9b4138e12f250e2e0a053202c9d3c1a431bf5e1d2b5f4fd9305400000009c173cb774f64456c228e8746fa6a6b1f9a9be8a798f2ca6d77de74ea4b3772666d6304e67b6e48901c5649032113d0272d3926047c14b796f6892067ce10bff	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2353101362"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31082338"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2361695444"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B7D16078-B355-11EE-8184-6A04C5405167} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803cff7c6247da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2353101362"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f047077c6247da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005d05a5489e56c74eaa6b39ab0831a11f00000000020000000000106600000001000020000000a4e134146a080dc8c105ae038203b4e8d67bacce18f136b828582a1675fe7133000000000e8000000002000020000000f92cfeabf1bc761e398b484447ec016202d995e86fd119b1b3e9d5e087b9e5aa20000000481ef095dcbe214eaea978feaab7198ab70706b9dd131f6d5bd06c022161f7f94000000042312676ec722c3bc3690e7d7129b62e0780be330e1e865f557bd70680030841a1b1409941175ee5519508c4686edd880a58fd9a5742eac3bdc4ad30405a67ef	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412054098"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-768304381-2824894965-3840216961-1000\{F1C1771B-11D6-402D-90DE-AF261241C8BB}	IEXPLORE.EXE

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4668	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4668	IEXPLORE.EXE
Token: SeShutdownPrivilege	4668	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4668	IEXPLORE.EXE
Token: SeShutdownPrivilege	4668	IEXPLORE.EXE
Token: SeCreatePagefilePrivilege	4668	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1900	iexplore.exe
1900	iexplore.exe
4668	IEXPLORE.EXE
4668	IEXPLORE.EXE
4668	IEXPLORE.EXE
4668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 4668	1900	iexplore.exe	86
PID 1900 wrote to memory of 4668	1900	iexplore.exe	86
PID 1900 wrote to memory of 4668	1900	iexplore.exe	86

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c029858cd962da7c2f06f4629901818.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4668

Network

DNS

2.136.104.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.136.104.51.in-addr.arpa

IN PTR

Response
DNS

frookshop-winsive.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

frookshop-winsive.com

IN A

Response

frookshop-winsive.com

IN A

18.158.88.249
GET

https://frookshop-winsive.com/83bb5365-7ea1-4b4a-bf34-8f6a6eed7200?c2=26233199&c1=affC1627682958aff4a9a449f59102a177a769

IEXPLORE.EXE

Remote address:

18.158.88.249:443

Request

GET /83bb5365-7ea1-4b4a-bf34-8f6a6eed7200?c2=26233199&c1=affC1627682958aff4a9a449f59102a177a769 HTTP/2.0
host: frookshop-winsive.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

server: nginx
date: Mon, 15 Jan 2024 03:25:26 GMT
content-type: text/html;charset=UTF-8
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
set-cookie: 83bb5365-7ea1-4b4a-bf34-8f6a6eed7200-v4=_mGilQRmNRWSZ7-BqtK_kuMflLyJqaiy6mOEiSem7oY; Max-Age=86400; Expires=Tue, 16-Jan-2024 03:25:26 GMT; Domain=frookshop-winsive.com; Path=/; Secure; HttpOnly;SameSite=None
set-cookie: cc-v4=Y7LM9xqgVO1NC%2BxFaHzip%2Bx%2F61pggCt2h39wqf7r6hdZSCnPr7v34UrwBASCW85z03Q%2Bu7w4L9ICevDt2IXRiaE1OKkC0wN60hRnDPe8BzdQ2AXZYq%2FykrFACRGurJi0P86UGEBmaAk79%2FG6NXhCZA%3D%3D; Max-Age=31536000; Expires=Tue, 14-Jan-2025 03:25:26 GMT; Domain=frookshop-winsive.com; Path=/; Secure; HttpOnly;SameSite=None
DNS

180.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

180.178.17.96.in-addr.arpa

IN PTR

Response

180.178.17.96.in-addr.arpa

IN PTR

a96-17-178-180deploystaticakamaitechnologiescom
DNS

249.88.158.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

249.88.158.18.in-addr.arpa

IN PTR

Response

249.88.158.18.in-addr.arpa

IN PTR

ec2-18-158-88-249eu-central-1compute amazonawscom
DNS

40.13.222.173.in-addr.arpa

Remote address:

8.8.8.8:53

Request

40.13.222.173.in-addr.arpa

IN PTR

Response

40.13.222.173.in-addr.arpa

IN PTR

a173-222-13-40deploystaticakamaitechnologiescom
DNS

20.177.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

20.177.190.20.in-addr.arpa

IN PTR

Response
DNS

reletinglablets.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

reletinglablets.com

IN A

Response

reletinglablets.com

IN A

18.158.88.249
GET

https://reletinglablets.com/redirect?target=BASE64aHR0cHM6Ly8xLmV3amZ3Zi5jby8_dXRtX21lZGl1bT1jMmI2YzBkMDhiNWIwN2Y1MzhmODBiYTU4NTc4YTQxMzk0N2U5MTBiJnV0bV9jYW1wYWlnbj1qYW4yNG1haW5lciYxPTI2MjMzMTk5JmNpZD13Ym1lM3VtMjl0N2tzYmZ1aW5mbTk4Mm8&ts=1705289126048&hash=7IcsPlyd5D73ZnmPRCZx-9eQsqeEX6dVdASlIVL2oDY&rm=D

IEXPLORE.EXE

Remote address:

18.158.88.249:443

Request

GET /redirect?target=BASE64aHR0cHM6Ly8xLmV3amZ3Zi5jby8_dXRtX21lZGl1bT1jMmI2YzBkMDhiNWIwN2Y1MzhmODBiYTU4NTc4YTQxMzk0N2U5MTBiJnV0bV9jYW1wYWlnbj1qYW4yNG1haW5lciYxPTI2MjMzMTk5JmNpZD13Ym1lM3VtMjl0N2tzYmZ1aW5mbTk4Mm8&ts=1705289126048&hash=7IcsPlyd5D73ZnmPRCZx-9eQsqeEX6dVdASlIVL2oDY&rm=D HTTP/2.0
host: reletinglablets.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

server: nginx
date: Mon, 15 Jan 2024 03:25:27 GMT
content-type: text/html;charset=UTF-8
cache-control: no-store, no-cache, pre-check=0, post-check=0
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
DNS

1.ewjfwf.co

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

1.ewjfwf.co

IN A

Response

1.ewjfwf.co

IN A

69.175.103.179
GET

https://1.ewjfwf.co/?utm_medium=c2b6c0d08b5b07f538f80ba58578a413947e910b&utm_campaign=jan24mainer&1=26233199&cid=wbme3um29t7ksbfuinfm982o

IEXPLORE.EXE

Remote address:

69.175.103.179:443

Request

GET /?utm_medium=c2b6c0d08b5b07f538f80ba58578a413947e910b&utm_campaign=jan24mainer&1=26233199&cid=wbme3um29t7ksbfuinfm982o HTTP/2.0
host: 1.ewjfwf.co
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

server: nginx
date: Mon, 15 Jan 2024 03:25:29 GMT
content-type: text/html; charset=utf-8
vary: Accept-Encoding
x-powered-by: PHP/8.3.1
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
content-encoding: gzip
GET

https://1.ewjfwf.co/favicon.ico

IEXPLORE.EXE

Remote address:

69.175.103.179:443

Request

GET /favicon.ico HTTP/2.0
host: 1.ewjfwf.co
accept: */*
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko

Response

HTTP/2.0 200

server: nginx
date: Mon, 15 Jan 2024 03:25:29 GMT
content-type: image/x-icon
content-length: 1150
last-modified: Fri, 11 Aug 2023 10:37:02 GMT
etag: "64d60f4e-47e"
expires: Tue, 16 Jan 2024 03:25:29 GMT
cache-control: max-age=86400
strict-transport-security: max-age=31536000; includeSubdomains
accept-ranges: bytes
GET

https://1.ewjfwf.co/proc.php?145dc5804fc0ea4555c4ff571938eeca2ee4549b

IEXPLORE.EXE

Remote address:

69.175.103.179:443

Request

GET /proc.php?145dc5804fc0ea4555c4ff571938eeca2ee4549b HTTP/2.0
host: 1.ewjfwf.co
accept: text/html, application/xhtml+xml, image/jxr, */*
referer: https://1.ewjfwf.co/?utm_medium=c2b6c0d08b5b07f538f80ba58578a413947e910b&utm_campaign=jan24mainer&1=26233199&cid=wbme3um29t7ksbfuinfm982o
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

server: nginx
date: Mon, 15 Jan 2024 03:25:29 GMT
content-type: text/html; charset=UTF-8
location: https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909
vary: Accept-Encoding
x-powered-by: PHP/8.3.1
cache-control: no-store, no-cache, must-revalidate, max-age=0
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
accept-ch: Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version
content-encoding: gzip
DNS

233.38.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

233.38.18.104.in-addr.arpa

IN PTR

Response
DNS

www.tropbikewall.art

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.tropbikewall.art

IN A

Response

www.tropbikewall.art

IN CNAME

tropbikewall.art

tropbikewall.art

IN A

51.68.82.147

tropbikewall.art

IN A

51.68.81.31

tropbikewall.art

IN A

51.68.85.158
GET

https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909

IEXPLORE.EXE

Remote address:

51.68.82.147:443

Request

GET /?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909 HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Referer: https://1.ewjfwf.co/proc.php?145dc5804fc0ea4555c4ff571938eeca2ee4549b
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.tropbikewall.art
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Mon, 15 Jan 2024 03:25:29 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: no-transform
Accept-CH: Sec-CH-UA-Platform-Version
GET

https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909&eyeg=fbbd069aa76e2af222f59c42012c29ba&eyer=0.15899866522703998&eyei=0&eyew=1280&eyeh=602&eyetd=220&eyef=1.ewjfwf.co

IEXPLORE.EXE

Remote address:

51.68.82.147:443

Request

GET /?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909&eyeg=fbbd069aa76e2af222f59c42012c29ba&eyer=0.15899866522703998&eyei=0&eyew=1280&eyeh=602&eyetd=220&eyef=1.ewjfwf.co HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.tropbikewall.art
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Date: Mon, 15 Jan 2024 03:25:29 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-transform
Location: https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909&eyeg=3&eyer=0.15899866522703998&eyei=0&eyew=1280&eyeh=602&eyetd=220&eyef=1.ewjfwf.co
GET

https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909&eyeg=3&eyer=0.15899866522703998&eyei=0&eyew=1280&eyeh=602&eyetd=220&eyef=1.ewjfwf.co

IEXPLORE.EXE

Remote address:

51.68.82.147:443

Request

GET /?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909&eyeg=3&eyer=0.15899866522703998&eyei=0&eyew=1280&eyeh=602&eyetd=220&eyef=1.ewjfwf.co HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.tropbikewall.art
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

Date: Mon, 15 Jan 2024 03:25:29 GMT
Content-Length: 0
Connection: keep-alive
Cache-Control: no-transform
Location: https://admoustache.media-412.com/sl?id=63ef5a2a8dec34873b6049c7&pid=503&sub1=330001e4438953230d16bef60e6616691f3170115-202401-flb*5706540-e4d07*M7324161039296102433*sl_5706540-e4d07*85048f6de5463ac0165c5648aa33499dae001331*909-d3ba45d7*909
DNS

admoustache.media-412.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

admoustache.media-412.com

IN A

Response

admoustache.media-412.com

IN A

34.90.46.36

admoustache.media-412.com

IN A

34.91.27.112

admoustache.media-412.com

IN A

34.141.137.168

admoustache.media-412.com

IN A

34.147.1.177
GET

https://admoustache.media-412.com/sl?id=63ef5a2a8dec34873b6049c7&pid=503&sub1=330001e4438953230d16bef60e6616691f3170115-202401-flb*5706540-e4d07*M7324161039296102433*sl_5706540-e4d07*85048f6de5463ac0165c5648aa33499dae001331*909-d3ba45d7*909

IEXPLORE.EXE

Remote address:

34.90.46.36:443

Request

GET /sl?id=63ef5a2a8dec34873b6049c7&pid=503&sub1=330001e4438953230d16bef60e6616691f3170115-202401-flb*5706540-e4d07*M7324161039296102433*sl_5706540-e4d07*85048f6de5463ac0165c5648aa33499dae001331*909-d3ba45d7*909 HTTP/2.0
host: admoustache.media-412.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 302

server: nginx
date: Mon, 15 Jan 2024 03:25:30 GMT
content-length: 0
location: https://dolpusads.aftrad-visit.com/track/smartlink?smartlink_id=6&publisher_id=34&network_id=1&click_id=65a4a5aaf1e76300014bd50b&source=503
x-adjust-use-original-forwarded-for: 1
referer:
referrer-policy: no-referrer
set-cookie: afclick=65a4a5aaf1e76300014bd50b; expires=Tue, 14 Jan 2025 03:25:30 GMT; secure; SameSite=None
access-control-allow-origin: *
DNS

179.103.175.69.in-addr.arpa

Remote address:

8.8.8.8:53

Request

179.103.175.69.in-addr.arpa

IN PTR

Response

179.103.175.69.in-addr.arpa

IN PTR

server04com-2mobi
DNS

147.82.68.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

147.82.68.51.in-addr.arpa

IN PTR

Response
DNS

dolpusads.aftrad-visit.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

dolpusads.aftrad-visit.com

IN A

Response

dolpusads.aftrad-visit.com

IN A

104.21.51.3

dolpusads.aftrad-visit.com

IN A

172.67.215.123
GET

https://dolpusads.aftrad-visit.com/track/smartlink?smartlink_id=6&publisher_id=34&network_id=1&click_id=65a4a5aaf1e76300014bd50b&source=503

IEXPLORE.EXE

Remote address:

104.21.51.3:443

Request

GET /track/smartlink?smartlink_id=6&publisher_id=34&network_id=1&click_id=65a4a5aaf1e76300014bd50b&source=503 HTTP/2.0
host: dolpusads.aftrad-visit.com
accept: text/html, application/xhtml+xml, image/jxr, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

date: Mon, 15 Jan 2024 03:25:30 GMT
content-type: text/html; charset=utf-8
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KZReZ2TJDq0vuDtopn6rhSq9VlO%2Bv92gs3nqU2tr8jhQTbsXLaNSJHnP4aRGJwpUyfNaXe9S0fpR%2FjsdQaulu51NHSgbeE7%2Ftu1Dko%2BZb35W%2BRj4DxW5L55vPCC3%2B2FvkVOqMfxYEaTawISujw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 845b030c6e848895-LHR
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
DNS

thestreamingworld.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

thestreamingworld.com

IN A

Response

thestreamingworld.com

IN A

104.21.90.163

thestreamingworld.com

IN A

172.67.202.116
GET

https://thestreamingworld.com/prllw/en/

IEXPLORE.EXE

Remote address:

104.21.90.163:443

Request

GET /prllw/en/ HTTP/2.0
host: thestreamingworld.com
accept: text/html, application/xhtml+xml, image/jxr, */*
referer: https://dolpusads.aftrad-visit.com/track/smartlink?smartlink_id=6&publisher_id=34&network_id=1&click_id=65a4a5aaf1e76300014bd50b&source=503
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

date: Mon, 15 Jan 2024 03:25:31 GMT
content-type: text/html
last-modified: Thu, 11 Jan 2024 16:44:41 GMT
cache-control: max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nUAoLjVQ2ITFc09uowuzE14G6%2FDSRRaU7N4jH1byO25tFDlzveI606aw92qTqvnwGoQTqRN80S02JY2TjE5NE0zgCNAs%2FjiQZ%2FSPaCoPFXh8QzoYwC6QRl6ixLJm5cwKkMKgPmzkDXU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 845b030dcd394165-LHR
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
GET

https://thestreamingworld.com/prllw/en/css/import.css

IEXPLORE.EXE

Remote address:

104.21.90.163:443

Request

GET /prllw/en/css/import.css HTTP/2.0
host: thestreamingworld.com
accept: text/css, */*
referer: https://thestreamingworld.com/prllw/en/
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

date: Mon, 15 Jan 2024 03:25:31 GMT
content-type: text/css
content-length: 46
last-modified: Thu, 11 Jan 2024 16:44:41 GMT
etag: "65a01af9-2e"
cache-control: max-age=14400
cf-cache-status: HIT
age: 3392
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=esm8qAEgwF48Xoe0wh8HilqSdMEJk62J%2FDHtPX9t9rocI1nUxX3%2FH%2BSa1m%2FMbmhgdvBXkb5VBw1kCY6xbQFQstPkFvyT8U6mram8TEk5J%2FW%2BHO9ztk6hS%2FR3ClZutzKOTfwoTvp%2By3E%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 845b030e9e004165-LHR
alt-svc: h3=":443"; ma=86400
GET

https://thestreamingworld.com/prllw/en/css/styles.css

IEXPLORE.EXE

Remote address:

104.21.90.163:443

Request

GET /prllw/en/css/styles.css HTTP/2.0
host: thestreamingworld.com
accept: text/css, */*
referer: https://thestreamingworld.com/prllw/en/
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

date: Mon, 15 Jan 2024 03:25:31 GMT
content-type: text/css
last-modified: Thu, 11 Jan 2024 16:44:41 GMT
etag: W/"65a01af9-731"
cache-control: max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tPz6SFNSj38WiDj0W6ELDKZrR58otnEjCXIRjYhzrKHG2TnWcoNkR8vMjMxF7MJHX0K%2F44%2BnvYlPFHMNELqIxWg7EIO5ditz%2FZkJlLdrXlXRO2H0nMQNHbNciDxI12GIvJFZzC1uapM%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 845b030f0e5a4165-LHR
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
GET

https://thestreamingworld.com/prllw/en/css/overrides.css

IEXPLORE.EXE

Remote address:

104.21.90.163:443

Request

GET /prllw/en/css/overrides.css HTTP/2.0
host: thestreamingworld.com
accept: text/css, */*
referer: https://thestreamingworld.com/prllw/en/
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

date: Mon, 15 Jan 2024 03:25:31 GMT
content-type: text/css
last-modified: Thu, 11 Jan 2024 16:44:41 GMT
etag: W/"65a01af9-eab"
cache-control: max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kDOcVMOERAEdGgBrWYP4CWek2Z%2BiNoKfxXyoEMIbicOTgoFW0FUX%2FxCzjT6vU4%2Bcvg2QZmWAaYw%2FBAAULFNmI9Oh37JNZkMNrZLukQJc9nj%2FgpNzuly7QxGeOJQvJiZiOCcFpnwHnMA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 845b030efe594165-LHR
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
GET

https://thestreamingworld.com/favicon.ico

IEXPLORE.EXE

Remote address:

104.21.90.163:443

Request

GET /favicon.ico HTTP/2.0
host: thestreamingworld.com
accept: */*
accept-encoding: gzip, deflate
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko

Response

HTTP/2.0 404

date: Mon, 15 Jan 2024 03:25:31 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: EXPIRED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KSrXCC8t4e8S0UAkk01kha6r%2B4%2BFPyFTuzqmeipfNz%2BgTKiUkYjnzka6oVBK%2FLlrpUvD%2BPyU0rVgPSkPIzc5cuqdaN8eMQc7uQsIzS9jTcwtfb%2F35evL0S9cnDZEYXSXzjDBkKO0sMU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 845b0310ffb24165-LHR
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
GET

https://thestreamingworld.com/prllw/en/mov_bbb.mp4

IEXPLORE.EXE

Remote address:

104.21.90.163:443

Request

GET /prllw/en/mov_bbb.mp4 HTTP/2.0
host: thestreamingworld.com
range: bytes=0-
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
referer: https://thestreamingworld.com/prllw/en/
getcontentfeatures.dlna.org: 1
accept-language: en-US
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

date: Mon, 15 Jan 2024 03:25:32 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: HIT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B5hlbenheZ0GxLfwaeF%2FJeqEMo7dAxeaUE0DMjcKlsHskOQtPcHQZZWyKVnU0SNsrzEHiN123QKGJnwMnXZZDRwP4vWb54UoIRi0vIT3q8BZpSpIeqP4czlLzRiak3FgTdW8AhvCPmg%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 845b03136a314165-LHR
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
GET

https://thestreamingworld.com/prllw/en/mov_bbb.mp4

IEXPLORE.EXE

Remote address:

104.21.90.163:443

Request

GET /prllw/en/mov_bbb.mp4 HTTP/2.0
host: thestreamingworld.com
range: bytes=0-
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
referer: https://thestreamingworld.com/prllw/en/
getcontentfeatures.dlna.org: 1
accept-language: en-US
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

date: Mon, 15 Jan 2024 03:25:32 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: HIT
age: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7fhsoSESdh68t%2FGbAwl2YD%2BRrgnAyQwFLF%2Fs2cF712KpEEOOBBzGD3gW3u22G1mZlwIUAMllzXN%2Fup1C%2BZaFyorLatRcrjbe6bpOhMZczRSl48vKcNNML%2FzzvwbxXPo7aBC3FgTs1Ko%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 845b0313eacb4165-LHR
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
GET

https://thestreamingworld.com/prllw/en/mov_bbb.mp4

IEXPLORE.EXE

Remote address:

104.21.90.163:443

Request

GET /prllw/en/mov_bbb.mp4 HTTP/2.0
host: thestreamingworld.com
range: bytes=0-
accept: */*
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
referer: https://thestreamingworld.com/prllw/en/
getcontentfeatures.dlna.org: 1
accept-language: en-US
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

date: Mon, 15 Jan 2024 03:25:32 GMT
content-type: text/html
cache-control: max-age=14400
cf-cache-status: HIT
age: 0
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eLyaRj%2BHTEz8Ip4grffnx4Xe8TQq7Blgbi%2BDa0a%2BfHbQJJRji8fxnU0X%2B71CdDa%2BG9pi%2B1XgXbnI1auI09ZBYcbnMm3GNaKQ1JbwNVxJ7nNB3MIqqFhVZZ%2FuzRiZsUCFc5XGEW1Ccgw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 845b03144b2f4165-LHR
content-encoding: gzip
alt-svc: h3=":443"; ma=86400
DNS

36.46.90.34.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.46.90.34.in-addr.arpa

IN PTR

Response

36.46.90.34.in-addr.arpa

IN PTR

36469034bcgoogleusercontentcom
DNS

3.51.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.51.21.104.in-addr.arpa

IN PTR

Response
DNS

36.249.124.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.249.124.192.in-addr.arpa

IN PTR

Response

36.249.124.192.in-addr.arpa

IN PTR

cloudproxy10036sucurinet
DNS

94.193.125.74.in-addr.arpa

Remote address:

8.8.8.8:53

Request

94.193.125.74.in-addr.arpa

IN PTR

Response

94.193.125.74.in-addr.arpa

IN PTR

ig-in-f941e100net

94.193.125.74.in-addr.arpa

IN PTR

di-in-f94�B
DNS

cdn.diclotrans.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

cdn.diclotrans.com

IN A

Response

cdn.diclotrans.com

IN A

104.21.54.145

cdn.diclotrans.com

IN A

172.67.139.102
GET

https://cdn.diclotrans.com/sdk/v1/801/ba21c50491451ae9da55a06b3748ebe97d2458f6/lib.js

IEXPLORE.EXE

Remote address:

104.21.54.145:443

Request

GET /sdk/v1/801/ba21c50491451ae9da55a06b3748ebe97d2458f6/lib.js HTTP/2.0
host: cdn.diclotrans.com
accept: application/javascript, */*;q=0.8
referer: https://thestreamingworld.com/prllw/en/
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

date: Mon, 15 Jan 2024 03:25:31 GMT
content-type: text/javascript
content-length: 9545
cache-control: public, max-age=14400, s-maxage=3600, proxy-revalidate
referrer-policy: origin
vary: accept-encoding
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Sun, 14 Jan 2024 23:20:49 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BLhRYpHy4DIfKy6npRr50UtNdY9kzWeuHmo4JWSNvLV%2FPPUz2aiG5OAW9i0kXGqK9SzMVS%2BwjvsPW6QF28XioRKYJjblD%2Fl1TDQqP3zY%2BAx6sepJltvvgkISSE1S0k%2Bh6nMcmDs%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 845b030f7af3416a-LHR
alt-svc: h3=":443"; ma=86400
GET

https://cdn.diclotrans.com/sdk/v1/1442/da6618f38ad281cc7e303b6d971098f2b9484f6d/lib.js

IEXPLORE.EXE

Remote address:

104.21.54.145:443

Request

GET /sdk/v1/1442/da6618f38ad281cc7e303b6d971098f2b9484f6d/lib.js HTTP/2.0
host: cdn.diclotrans.com
accept: application/javascript, */*;q=0.8
referer: https://thestreamingworld.com/prllw/en/
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

date: Mon, 15 Jan 2024 03:25:31 GMT
content-type: text/javascript
content-length: 6860
cache-control: public, max-age=14400, s-maxage=3600, proxy-revalidate
referrer-policy: origin
vary: accept-encoding
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Sun, 14 Jan 2024 23:20:49 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BYdvX1%2FDE9RQeN6TNQAGl4bloNmpCR06koCm1L9IzdwCwXCgAAVVIpUOZioRRWDRJAsBpla0KQRGuLdBIuQTepwR%2BFo29N0NaLOEcfK0qzWISjonSXNwRJdChF%2BzrM0s3AwhMPw%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 845b030f7af4416a-LHR
alt-svc: h3=":443"; ma=86400
GET

https://cdn.diclotrans.com/sdk/v1/1444/433b3539610fdf96f774f9a640e9d2716a5a8d2d/lib.js

IEXPLORE.EXE

Remote address:

104.21.54.145:443

Request

GET /sdk/v1/1444/433b3539610fdf96f774f9a640e9d2716a5a8d2d/lib.js HTTP/2.0
host: cdn.diclotrans.com
accept: application/javascript, */*;q=0.8
referer: https://thestreamingworld.com/prllw/en/
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 200

date: Mon, 15 Jan 2024 03:25:31 GMT
content-type: text/javascript
content-length: 3636
cache-control: public, max-age=14400, s-maxage=3600, proxy-revalidate
referrer-policy: origin
vary: accept-encoding
content-encoding: gzip
cf-cache-status: EXPIRED
last-modified: Sun, 14 Jan 2024 23:20:49 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=F4920Y199ZqaGINH8qPDVNagK5kGaZ4mo184BI5JSoZDcAeJ2XpjkSkGBpOAGwT2zYm5WshRjJoAxMiQqxgCDJPoARwWgugxLYeSxPMvCIOC92OtDHtwLncwtNSnq2vmJQhuMgo%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 845b030f7af2416a-LHR
alt-svc: h3=":443"; ma=86400
DNS

163.90.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

163.90.21.104.in-addr.arpa

IN PTR

Response
DNS

145.54.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.54.21.104.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

161.19.199.152.in-addr.arpa

Remote address:

8.8.8.8:53

Request

161.19.199.152.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

18.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.134.221.88.in-addr.arpa

IN PTR

Response

18.134.221.88.in-addr.arpa

IN PTR

a88-221-134-18deploystaticakamaitechnologiescom
DNS

18.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.134.221.88.in-addr.arpa

IN PTR

Response

18.134.221.88.in-addr.arpa

IN PTR

a88-221-134-18deploystaticakamaitechnologiescom
DNS

187.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

187.178.17.96.in-addr.arpa

IN PTR

Response

187.178.17.96.in-addr.arpa

IN PTR

a96-17-178-187deploystaticakamaitechnologiescom
DNS

187.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

187.178.17.96.in-addr.arpa

IN PTR

Response

187.178.17.96.in-addr.arpa

IN PTR

a96-17-178-187deploystaticakamaitechnologiescom
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet
DNS

200.197.79.204.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.197.79.204.in-addr.arpa

IN PTR

Response

200.197.79.204.in-addr.arpa

IN PTR

a-0001a-msedgenet
DNS

22.236.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.236.111.52.in-addr.arpa

IN PTR

Response
DNS

22.236.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

22.236.111.52.in-addr.arpa

IN PTR

Response

18.158.88.249:443

https://frookshop-winsive.com/83bb5365-7ea1-4b4a-bf34-8f6a6eed7200?c2=26233199&c1=affC1627682958aff4a9a449f59102a177a769

tls, http2

IEXPLORE.EXE

1.6kB
7.2kB
21
17

HTTP Request

GET https://frookshop-winsive.com/83bb5365-7ea1-4b4a-bf34-8f6a6eed7200?c2=26233199&c1=affC1627682958aff4a9a449f59102a177a769

HTTP Response

200
18.158.88.249:443

frookshop-winsive.com

tls, http2

IEXPLORE.EXE

1.3kB
6.0kB
19
15
18.158.88.249:443

https://reletinglablets.com/redirect?target=BASE64aHR0cHM6Ly8xLmV3amZ3Zi5jby8_dXRtX21lZGl1bT1jMmI2YzBkMDhiNWIwN2Y1MzhmODBiYTU4NTc4YTQxMzk0N2U5MTBiJnV0bV9jYW1wYWlnbj1qYW4yNG1haW5lciYxPTI2MjMzMTk5JmNpZD13Ym1lM3VtMjl0N2tzYmZ1aW5mbTk4Mm8&ts=1705289126048&hash=7IcsPlyd5D73ZnmPRCZx-9eQsqeEX6dVdASlIVL2oDY&rm=D

tls, http2

IEXPLORE.EXE

1.8kB
7.2kB
21
17

HTTP Request

GET https://reletinglablets.com/redirect?target=BASE64aHR0cHM6Ly8xLmV3amZ3Zi5jby8_dXRtX21lZGl1bT1jMmI2YzBkMDhiNWIwN2Y1MzhmODBiYTU4NTc4YTQxMzk0N2U5MTBiJnV0bV9jYW1wYWlnbj1qYW4yNG1haW5lciYxPTI2MjMzMTk5JmNpZD13Ym1lM3VtMjl0N2tzYmZ1aW5mbTk4Mm8&ts=1705289126048&hash=7IcsPlyd5D73ZnmPRCZx-9eQsqeEX6dVdASlIVL2oDY&rm=D

HTTP Response

200
18.158.88.249:443

reletinglablets.com

tls, http2

IEXPLORE.EXE

1.2kB
6.5kB
17
14
69.175.103.179:443

1.ewjfwf.co

tls, http2

IEXPLORE.EXE

1.2kB
4.3kB
17
13
69.175.103.179:443

https://1.ewjfwf.co/proc.php?145dc5804fc0ea4555c4ff571938eeca2ee4549b

tls, http2

IEXPLORE.EXE

2.1kB
10.5kB
26
20

HTTP Request

GET https://1.ewjfwf.co/?utm_medium=c2b6c0d08b5b07f538f80ba58578a413947e910b&utm_campaign=jan24mainer&1=26233199&cid=wbme3um29t7ksbfuinfm982o

HTTP Response

200

HTTP Request

GET https://1.ewjfwf.co/favicon.ico

HTTP Request

GET https://1.ewjfwf.co/proc.php?145dc5804fc0ea4555c4ff571938eeca2ee4549b

HTTP Response

200

HTTP Response

200
51.68.82.147:443

https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909&eyeg=3&eyer=0.15899866522703998&eyei=0&eyew=1280&eyeh=602&eyetd=220&eyef=1.ewjfwf.co

tls, http

IEXPLORE.EXE

2.9kB
11.9kB
24
18

HTTP Request

GET https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909

HTTP Response

200

HTTP Request

GET https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909&eyeg=fbbd069aa76e2af222f59c42012c29ba&eyer=0.15899866522703998&eyei=0&eyew=1280&eyeh=602&eyetd=220&eyef=1.ewjfwf.co

HTTP Response

302

HTTP Request

GET https://www.tropbikewall.art/?sl=5706540-e4d07&data1=Track1&data2=Track2&tag=M7324161039296102433&website=909-d3ba45d7&placement=909&eyeg=3&eyer=0.15899866522703998&eyei=0&eyew=1280&eyeh=602&eyetd=220&eyef=1.ewjfwf.co

HTTP Response

302
51.68.82.147:443

www.tropbikewall.art

tls

IEXPLORE.EXE

936 B
6.2kB
14
11
34.90.46.36:443

https://admoustache.media-412.com/sl?id=63ef5a2a8dec34873b6049c7&pid=503&sub1=330001e4438953230d16bef60e6616691f3170115-202401-flb*5706540-e4d07*M7324161039296102433*sl_5706540-e4d07*85048f6de5463ac0165c5648aa33499dae001331*909-d3ba45d7*909

tls, http2

IEXPLORE.EXE

1.6kB
7.0kB
20
17

HTTP Request

GET https://admoustache.media-412.com/sl?id=63ef5a2a8dec34873b6049c7&pid=503&sub1=330001e4438953230d16bef60e6616691f3170115-202401-flb*5706540-e4d07*M7324161039296102433*sl_5706540-e4d07*85048f6de5463ac0165c5648aa33499dae001331*909-d3ba45d7*909

HTTP Response

302
34.90.46.36:443

admoustache.media-412.com

tls, http2

IEXPLORE.EXE

1.2kB
6.6kB
18
15
104.21.51.3:443

dolpusads.aftrad-visit.com

tls, http2

IEXPLORE.EXE

1.1kB
5.9kB
15
11
104.21.51.3:443

https://dolpusads.aftrad-visit.com/track/smartlink?smartlink_id=6&publisher_id=34&network_id=1&click_id=65a4a5aaf1e76300014bd50b&source=503

tls, http2

IEXPLORE.EXE

1.5kB
6.7kB
18
13

HTTP Request

GET https://dolpusads.aftrad-visit.com/track/smartlink?smartlink_id=6&publisher_id=34&network_id=1&click_id=65a4a5aaf1e76300014bd50b&source=503

HTTP Response

200
104.21.90.163:443

https://thestreamingworld.com/prllw/en/mov_bbb.mp4

tls, http2

IEXPLORE.EXE

3.4kB
17.8kB
47
36

HTTP Request

GET https://thestreamingworld.com/prllw/en/

HTTP Response

200

HTTP Request

GET https://thestreamingworld.com/prllw/en/css/import.css

HTTP Response

200

HTTP Request

GET https://thestreamingworld.com/prllw/en/css/styles.css

HTTP Request

GET https://thestreamingworld.com/prllw/en/css/overrides.css

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://thestreamingworld.com/favicon.ico

HTTP Response

404

HTTP Request

GET https://thestreamingworld.com/prllw/en/mov_bbb.mp4

HTTP Response

404

HTTP Request

GET https://thestreamingworld.com/prllw/en/mov_bbb.mp4

HTTP Response

404

HTTP Request

GET https://thestreamingworld.com/prllw/en/mov_bbb.mp4

HTTP Response

404
104.21.90.163:443

thestreamingworld.com

tls, http2

IEXPLORE.EXE

1.1kB
5.9kB
15
11
104.21.54.145:443

cdn.diclotrans.com

tls, http2

IEXPLORE.EXE

1.1kB
5.9kB
15
11
104.21.54.145:443

https://cdn.diclotrans.com/sdk/v1/1444/433b3539610fdf96f774f9a640e9d2716a5a8d2d/lib.js

tls, http2

IEXPLORE.EXE

2.7kB
28.7kB
42
36

HTTP Request

GET https://cdn.diclotrans.com/sdk/v1/801/ba21c50491451ae9da55a06b3748ebe97d2458f6/lib.js

HTTP Request

GET https://cdn.diclotrans.com/sdk/v1/1442/da6618f38ad281cc7e303b6d971098f2b9484f6d/lib.js

HTTP Request

GET https://cdn.diclotrans.com/sdk/v1/1444/433b3539610fdf96f774f9a640e9d2716a5a8d2d/lib.js

HTTP Response

200

HTTP Response

200

HTTP Response

200
104.21.54.145:443

cdn.diclotrans.com

tls, http2

IEXPLORE.EXE

1.0kB
5.9kB
14
10
204.79.197.200:443

ieonline.microsoft.com

tls, http2

iexplore.exe

1.2kB
8.3kB
15
14

8.8.8.8:53

2.136.104.51.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

2.136.104.51.in-addr.arpa
8.8.8.8:53

frookshop-winsive.com

dns

IEXPLORE.EXE

67 B
83 B
1
1

DNS Request

frookshop-winsive.com

DNS Response

18.158.88.249
8.8.8.8:53

180.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

180.178.17.96.in-addr.arpa
8.8.8.8:53

249.88.158.18.in-addr.arpa

dns

72 B
138 B
1
1

DNS Request

249.88.158.18.in-addr.arpa
8.8.8.8:53

40.13.222.173.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

40.13.222.173.in-addr.arpa
8.8.8.8:53

20.177.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

20.177.190.20.in-addr.arpa
8.8.8.8:53

reletinglablets.com

dns

IEXPLORE.EXE

65 B
81 B
1
1

DNS Request

reletinglablets.com

DNS Response

18.158.88.249
8.8.8.8:53

1.ewjfwf.co

dns

IEXPLORE.EXE

57 B
73 B
1
1

DNS Request

1.ewjfwf.co

DNS Response

69.175.103.179
8.8.8.8:53

233.38.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

233.38.18.104.in-addr.arpa
8.8.8.8:53

www.tropbikewall.art

dns

IEXPLORE.EXE

66 B
128 B
1
1

DNS Request

www.tropbikewall.art

DNS Response

51.68.82.147

51.68.81.31

51.68.85.158
8.8.8.8:53

admoustache.media-412.com

dns

IEXPLORE.EXE

71 B
135 B
1
1

DNS Request

admoustache.media-412.com

DNS Response

34.90.46.36

34.91.27.112

34.141.137.168

34.147.1.177
8.8.8.8:53

179.103.175.69.in-addr.arpa

dns

73 B
106 B
1
1

DNS Request

179.103.175.69.in-addr.arpa
8.8.8.8:53

147.82.68.51.in-addr.arpa

dns

71 B
125 B
1
1

DNS Request

147.82.68.51.in-addr.arpa
8.8.8.8:53

dolpusads.aftrad-visit.com

dns

IEXPLORE.EXE

72 B
104 B
1
1

DNS Request

dolpusads.aftrad-visit.com

DNS Response

104.21.51.3

172.67.215.123
8.8.8.8:53

thestreamingworld.com

dns

IEXPLORE.EXE

67 B
99 B
1
1

DNS Request

thestreamingworld.com

DNS Response

104.21.90.163

172.67.202.116
8.8.8.8:53

36.46.90.34.in-addr.arpa

dns

70 B
120 B
1
1

DNS Request

36.46.90.34.in-addr.arpa
8.8.8.8:53

3.51.21.104.in-addr.arpa

dns

70 B
132 B
1
1

DNS Request

3.51.21.104.in-addr.arpa
8.8.8.8:53

36.249.124.192.in-addr.arpa

dns

73 B
113 B
1
1

DNS Request

36.249.124.192.in-addr.arpa
8.8.8.8:53

94.193.125.74.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

94.193.125.74.in-addr.arpa
8.8.8.8:53

cdn.diclotrans.com

dns

IEXPLORE.EXE

64 B
96 B
1
1

DNS Request

cdn.diclotrans.com

DNS Response

104.21.54.145

172.67.139.102
8.8.8.8:53

163.90.21.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

163.90.21.104.in-addr.arpa
8.8.8.8:53

145.54.21.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

145.54.21.104.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

161.19.199.152.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

161.19.199.152.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

142 B
314 B
2
2

DNS Request

198.187.3.20.in-addr.arpa

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

18.134.221.88.in-addr.arpa

dns

144 B
274 B
2
2

DNS Request

18.134.221.88.in-addr.arpa

DNS Request

18.134.221.88.in-addr.arpa
8.8.8.8:53

187.178.17.96.in-addr.arpa

dns

144 B
274 B
2
2

DNS Request

187.178.17.96.in-addr.arpa

DNS Request

187.178.17.96.in-addr.arpa
8.8.8.8:53

200.197.79.204.in-addr.arpa

dns

146 B
212 B
2
2

DNS Request

200.197.79.204.in-addr.arpa

DNS Request

200.197.79.204.in-addr.arpa
8.8.8.8:53

22.236.111.52.in-addr.arpa

dns

144 B
316 B
2
2

DNS Request

22.236.111.52.in-addr.arpa

DNS Request

22.236.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
efbd8a07fc0323406b87fe9482489647

SHA1
a4ca4c45f3e746f5f6611c84890d03b32d937111

SHA256
351bfa58fa50d54bdfba5c6a37c4f8f9c6a88b979e1379ec0b0900b4ef0e4e19

SHA512
f6265b2220386ef317eabd2f073d362d4811260e87dc0d06057984ea12c39568fff99a485bd1f0f0a644e86df01d2697c679ca021d03b676b01875135316343f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
c40a32938a36d149a22910f17ba6a188

SHA1
77f4d1effb28324f9bf1178dde309a90e35ce2b6

SHA256
11570f5cc5b67e9a9f091fbdc897a1fb0661b2312e56044cc0101d1512a807bb

SHA512
0c9149f1dd9f89181a0088a8184cc2af1f0521d57205b6f131a8e3a366eaff01cacf0174dda2a218f2647913f8a8f8045174ed2f0f0edd63cfcd5f6236f6d3fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\25xleom\imagestore.dat

Filesize
1KB

MD5
f0383f87b7e3d7e9993a256cbc2ce355

SHA1
a6e56044dae77c6bcc93838440db3e96747fe7f6

SHA256
0737636c21f508f3db31d6e1fff02b30622156c5131e7d2e40cbdec16e1f1a10

SHA512
9b59c373b66f1ead3e47227f574b794b15795ab67c86c75a4f90f12ce5abee36b6e86254484b63ae0258145bb9b07ec5fc8613d6b379f6878f2a3a58054d5e88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C34XGPV\favicon[1].ico

Filesize
1KB

MD5
91abe01116ab422c598e9c8af72cf4da

SHA1
0f2815fe8e067d48537ad168225ab4674271fa27

SHA256
b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc

SHA512
a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C34XGPV\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request