hxxps://m[.]classdojo[.]com/track?uid=bb031a70-7384-4878-9fd5-606acf1ada85&txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_mime_type=html&bsft_tv=25&bsft_lx=2&a=click&redir=https%3A%2F%2Fgoogle[.]com%2Famp%2Fs%2Fmartynpinckard[.]co[.]nz/[.]well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==

Analysis

max time kernel
121s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 15:00 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://m.classdojo.com/track?uid=bb031a70-7384-4878-9fd5-606acf1ada85&txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_mime_type=html&bsft_tv=25&bsft_lx=2&a=click&redir=https%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fmartynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506684259011823"	chrome.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 3488	3784	chrome.exe	85
PID 3784 wrote to memory of 3488	3784	chrome.exe	85
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2852	3784	chrome.exe	90
PID 3784 wrote to memory of 2972	3784	chrome.exe	89
PID 3784 wrote to memory of 2972	3784	chrome.exe	89
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91
PID 3784 wrote to memory of 1728	3784	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://m.classdojo.com/track?uid=bb031a70-7384-4878-9fd5-606acf1ada85&txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_mime_type=html&bsft_tv=25&bsft_lx=2&a=click&redir=https%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fmartynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffc28bc9758,0x7ffc28bc9768,0x7ffc28bc9778
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3236 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3940 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4864 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5564 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5668 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
  2⤵
  PID:496

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3524

Network

DNS

m.classdojo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

m.classdojo.com

IN A

Response

m.classdojo.com

IN CNAME

links.getblueshift.com

links.getblueshift.com

IN CNAME

links.getblueshift.com.cdn.cloudflare.net

links.getblueshift.com.cdn.cloudflare.net

IN A

104.17.29.85

links.getblueshift.com.cdn.cloudflare.net

IN A

104.17.30.85
GET

https://m.classdojo.com/track?uid=bb031a70-7384-4878-9fd5-606acf1ada85&txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_mime_type=html&bsft_tv=25&bsft_lx=2&a=click&redir=https%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fmartynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==

chrome.exe

Remote address:

104.17.29.85:443

Request

GET /track?uid=bb031a70-7384-4878-9fd5-606acf1ada85&txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_mime_type=html&bsft_tv=25&bsft_lx=2&a=click&redir=https%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fmartynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ== HTTP/2.0
host: m.classdojo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 307

date: Thu, 25 Jan 2024 15:00:23 GMT
content-type: text/html; charset=utf-8
location: https://google.com/amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==?bsft_clkid=7c8321c8-6d5d-4e34-b406-380d1f1cf0e4&bsft_uid=bb031a70-7384-4878-9fd5-606acf1ada85&bsft_mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&bsft_txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_mime_type=html&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&bsft_lx=2&bsft_tv=25
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
cache-control: no-cache, no-store
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: *
access-control-allow-methods: POST, GET, OPTIONS
access-control-allow-headers: Content-Type, X-Api-Key
access-control-max-age: 1728000
x-request-id: f5772ae8-f5bf-485c-bf8b-85a87fbfa8b4
x-runtime: 0.008562
cf-cache-status: DYNAMIC
set-cookie: __cf_bm=fKQllFcJrQ_3TLN5LaC9PVndTjJ2V.eEHILd0.JUrgg-1706194823-1-AWzTHhIsHKsc7zx1uXUQD9y2C3uKdf+L9m5McsWnzdy5toy9DkFEjvQV15imgprmgD9pEeHPhTlQIvSskSQ05+Y=; path=/; expires=Thu, 25-Jan-24 15:30:23 GMT; domain=.m.classdojo.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 84b162abba4023e1-LHR
DNS

85.29.17.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

85.29.17.104.in-addr.arpa

IN PTR

Response
DNS

173.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

173.178.17.96.in-addr.arpa

IN PTR

Response

173.178.17.96.in-addr.arpa

IN PTR

a96-17-178-173deploystaticakamaitechnologiescom
DNS

google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

google.com

IN A

Response

google.com

IN A

142.250.180.14
GET

https://google.com/amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==?bsft_clkid=7c8321c8-6d5d-4e34-b406-380d1f1cf0e4&bsft_uid=bb031a70-7384-4878-9fd5-606acf1ada85&bsft_mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&bsft_txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_mime_type=html&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&bsft_lx=2&bsft_tv=25

chrome.exe

Remote address:

142.250.180.14:443

Request

GET /amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==?bsft_clkid=7c8321c8-6d5d-4e34-b406-380d1f1cf0e4&bsft_uid=bb031a70-7384-4878-9fd5-606acf1ada85&bsft_mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&bsft_txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_mime_type=html&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&bsft_lx=2&bsft_tv=25 HTTP/2.0
host: google.com
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-ch-ua-arch: "x86"
sec-ch-ua-platform-version: "10.0.0"
sec-ch-ua-model: ""
sec-ch-ua-bitness: "64"
sec-ch-ua-wow64: ?0
sec-ch-ua-full-version-list: "Chromium";v="106.0.5249.119", "Google Chrome";v="106.0.5249.119", "Not;A=Brand";v="99.0.0.0"
x-client-data: CPr2ygE=
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

183.142.211.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.142.211.20.in-addr.arpa

IN PTR

Response
DNS

14.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.180.250.142.in-addr.arpa

IN PTR

Response

14.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f141e100net
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

216.58.204.68
GET

https://www.google.com/amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==?bsft_clkid=7c8321c8-6d5d-4e34-b406-380d1f1cf0e4&bsft_uid=bb031a70-7384-4878-9fd5-606acf1ada85&bsft_mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&bsft_txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_mime_type=html&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&bsft_lx=2&bsft_tv=25

chrome.exe

Remote address:

216.58.204.68:443

Request

GET /amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==?bsft_clkid=7c8321c8-6d5d-4e34-b406-380d1f1cf0e4&bsft_uid=bb031a70-7384-4878-9fd5-606acf1ada85&bsft_mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&bsft_txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_mime_type=html&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&bsft_lx=2&bsft_tv=25 HTTP/2.0
host: www.google.com
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-ch-ua-arch: "x86"
sec-ch-ua-platform-version: "10.0.0"
sec-ch-ua-model: ""
sec-ch-ua-bitness: "64"
sec-ch-ua-wow64: ?0
sec-ch-ua-full-version-list: "Chromium";v="106.0.5249.119", "Google Chrome";v="106.0.5249.119", "Not;A=Brand";v="99.0.0.0"
x-client-data: CPr2ygE=
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: CONSENT=PENDING+157
DNS

martynpinckard.co.nz

chrome.exe

Remote address:

8.8.8.8:53

Request

martynpinckard.co.nz

IN A

Response

martynpinckard.co.nz

IN A

185.184.154.65
DNS

68.204.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

68.204.58.216.in-addr.arpa

IN PTR

Response

68.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f681e100net

68.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f4�H

68.204.58.216.in-addr.arpa

IN PTR

lhr48s49-in-f4�H
GET

https://martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==

chrome.exe

Remote address:

185.184.154.65:443

Request

GET /.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ== HTTP/2.0
host: martynpinckard.co.nz
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

server: nginx
date: Thu, 25 Jan 2024 15:00:27 GMT
content-type: text/html; charset=UTF-8
content-length: 142
x-powered-by: PHP/7.3.33
vary: Accept-Encoding
content-encoding: gzip
DNS

apps.identrust.com

chrome.exe

Remote address:

8.8.8.8:53

Request

apps.identrust.com

IN A

Response

apps.identrust.com

IN CNAME

identrust.edgesuite.net

identrust.edgesuite.net

IN CNAME

a1952.dscq.akamai.net

a1952.dscq.akamai.net

IN A

96.17.179.184

a1952.dscq.akamai.net

IN A

96.17.179.205
GET

http://apps.identrust.com/roots/dstrootcax3.p7c

chrome.exe

Remote address:

96.17.179.184:80

Request

GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: apps.identrust.com

Response

HTTP/1.1 200 OK

X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex
Referrer-Policy: same-origin
Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT
ETag: "37d-6079b8c0929c0"
Accept-Ranges: bytes
Content-Length: 893
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Type: application/pkcs7-mime
Cache-Control: max-age=3600
Expires: Thu, 25 Jan 2024 16:00:27 GMT
Date: Thu, 25 Jan 2024 15:00:27 GMT
Connection: keep-alive
DNS

65.154.184.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

65.154.184.185.in-addr.arpa

IN PTR

Response

65.154.184.185.in-addr.arpa

IN PTR

ipb9b89a41ipv4syd02dsnetwork
DNS

jg79qpbchy.q1pethfc.ru

chrome.exe

Remote address:

8.8.8.8:53

Request

jg79qpbchy.q1pethfc.ru

IN A

Response

jg79qpbchy.q1pethfc.ru

IN A

188.114.97.2

jg79qpbchy.q1pethfc.ru

IN A

188.114.96.2
GET

https://jg79qpbchy.q1pethfc.ru/46Q9ZrT/

chrome.exe

Remote address:

188.114.97.2:443

Request

GET /46Q9ZrT/ HTTP/2.0
host: jg79qpbchy.q1pethfc.ru
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://martynpinckard.co.nz/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 404

date: Thu, 25 Jan 2024 15:00:29 GMT
content-type: text/html; charset=UTF-8
set-cookie: PHPSESSID=ul5845h8mrkbjj2qcbf6jfpie8; path=/
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lDwLR3EYiV8wv7kG9XsX9f6KoKbRo4HpzvZ77azI3DmzKJ2YrYdCA4KJPiYJun%2BUZz7VEI1YYn1YlvCuQTsyCOiBj1uG5sh8QLioa83E0tdMLa5Y2L13C37zYU5T8wRx%2FK18Oz1NpGFz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 84b162ca883c79b3-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
DNS

184.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

184.179.17.96.in-addr.arpa

IN PTR

Response

184.179.17.96.in-addr.arpa

IN PTR

a96-17-179-184deploystaticakamaitechnologiescom
DNS

2.97.114.188.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.97.114.188.in-addr.arpa

IN PTR

Response
DNS

75.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

75.159.190.20.in-addr.arpa

IN PTR

Response
DNS

a.nel.cloudflare.com

chrome.exe

Remote address:

8.8.8.8:53

Request

a.nel.cloudflare.com

IN A

Response

a.nel.cloudflare.com

IN A

35.190.80.1
OPTIONS

https://a.nel.cloudflare.com/report/v3?s=lDwLR3EYiV8wv7kG9XsX9f6KoKbRo4HpzvZ77azI3DmzKJ2YrYdCA4KJPiYJun%2BUZz7VEI1YYn1YlvCuQTsyCOiBj1uG5sh8QLioa83E0tdMLa5Y2L13C37zYU5T8wRx%2FK18Oz1NpGFz

chrome.exe

Remote address:

35.190.80.1:443

Request

OPTIONS /report/v3?s=lDwLR3EYiV8wv7kG9XsX9f6KoKbRo4HpzvZ77azI3DmzKJ2YrYdCA4KJPiYJun%2BUZz7VEI1YYn1YlvCuQTsyCOiBj1uG5sh8QLioa83E0tdMLa5Y2L13C37zYU5T8wRx%2FK18Oz1NpGFz HTTP/2.0
host: a.nel.cloudflare.com
origin: https://jg79qpbchy.q1pethfc.ru
access-control-request-method: POST
access-control-request-headers: content-type
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

cdn.jsdelivr.net

chrome.exe

Remote address:

8.8.8.8:53

Request

cdn.jsdelivr.net

IN A

Response

cdn.jsdelivr.net

IN CNAME

jsdelivr.map.fastly.net

jsdelivr.map.fastly.net

IN A

151.101.1.229

jsdelivr.map.fastly.net

IN A

151.101.65.229

jsdelivr.map.fastly.net

IN A

151.101.129.229

jsdelivr.map.fastly.net

IN A

151.101.193.229
DNS

challenges.cloudflare.com

chrome.exe

Remote address:

8.8.8.8:53

Request

challenges.cloudflare.com

IN A

Response

challenges.cloudflare.com

IN A

104.17.2.184

challenges.cloudflare.com

IN A

104.17.3.184
GET

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

chrome.exe

Remote address:

151.101.1.229:443

Request

GET /npm/bootstrap@5.0.2/dist/css/bootstrap.min.css HTTP/2.0
host: cdn.jsdelivr.net
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://jg79qpbchy.q1pethfc.ru/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

access-control-allow-origin: *
access-control-expose-headers: *
timing-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cross-origin-resource-policy: cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: text/css; charset=utf-8
x-jsd-version: 5.0.2
x-jsd-version-type: version
etag: W/"260c5-fByeBXPlzqi603M74vxjqoxo6o0"
content-encoding: br
accept-ranges: bytes
date: Thu, 25 Jan 2024 15:00:29 GMT
age: 19718071
x-served-by: cache-fra-eddf8230097-FRA, cache-lon420147-LON
x-cache: HIT, HIT
vary: Accept-Encoding
alt-svc: h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
content-length: 25360
GET

https://challenges.cloudflare.com/turnstile/v0/api.js

chrome.exe

Remote address:

104.17.2.184:443

Request

GET /turnstile/v0/api.js HTTP/2.0
host: challenges.cloudflare.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://jg79qpbchy.q1pethfc.ru/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 302

date: Thu, 25 Jan 2024 15:00:29 GMT
cache-control: max-age=300, public
location: /turnstile/v0/g/ea25f566/api.js
vary: accept-encoding
access-control-allow-origin: *
server: cloudflare
cf-ray: 84b162d5ea336407-LHR
alt-svc: h3=":443"; ma=86400
DNS

1.80.190.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.80.190.35.in-addr.arpa

IN PTR

Response

1.80.190.35.in-addr.arpa

IN PTR

18019035bcgoogleusercontentcom
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

232.168.11.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.168.11.51.in-addr.arpa

IN PTR

Response
DNS

184.2.17.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

184.2.17.104.in-addr.arpa

IN PTR

Response
DNS

229.1.101.151.in-addr.arpa

Remote address:

8.8.8.8:53

Request

229.1.101.151.in-addr.arpa

IN PTR

Response
DNS

226.21.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.21.18.104.in-addr.arpa

IN PTR

Response
DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

178.223.142.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

178.223.142.52.in-addr.arpa

IN PTR

Response
DNS

157.123.68.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

157.123.68.40.in-addr.arpa

IN PTR

Response
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR

Response
DNS

0.205.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.205.248.87.in-addr.arpa

IN PTR

Response

0.205.248.87.in-addr.arpa

IN PTR

https-87-248-205-0lgwllnwnet
DNS

0.205.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

0.205.248.87.in-addr.arpa

IN PTR

Response

0.205.248.87.in-addr.arpa

IN PTR

https-87-248-205-0lgwllnwnet
DNS

180.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

180.178.17.96.in-addr.arpa

IN PTR

Response

180.178.17.96.in-addr.arpa

IN PTR

a96-17-178-180deploystaticakamaitechnologiescom
DNS

google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

google.com

IN A

Response

google.com

IN A

142.250.180.14
DNS

google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

google.com

IN A

Response

google.com

IN A

142.250.180.14
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

216.58.213.3
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

192.178.49.3
POST

https://beacons.gcp.gvt2.com/domainreliability/upload

chrome.exe

Remote address:

216.58.213.3:443

Request

POST /domainreliability/upload HTTP/2.0
host: beacons.gcp.gvt2.com
content-length: 297
content-type: application/json; charset=utf-8
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

3.213.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.213.58.216.in-addr.arpa

IN PTR

Response

3.213.58.216.in-addr.arpa

IN PTR

ber01s14-in-f31e100net

3.213.58.216.in-addr.arpa

IN PTR

lhr25s25-in-f3�F
DNS

134.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

134.32.126.40.in-addr.arpa

IN PTR

Response
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response
DNS

content-autofill.googleapis.com

chrome.exe

Remote address:

8.8.8.8:53

Request

content-autofill.googleapis.com

IN A

Response

content-autofill.googleapis.com

IN A

142.250.187.202

content-autofill.googleapis.com

IN A

142.250.187.234

content-autofill.googleapis.com

IN A

172.217.16.234

content-autofill.googleapis.com

IN A

142.250.200.42

content-autofill.googleapis.com

IN A

142.250.200.10

content-autofill.googleapis.com

IN A

142.250.178.10

content-autofill.googleapis.com

IN A

216.58.201.106

content-autofill.googleapis.com

IN A

216.58.204.74

content-autofill.googleapis.com

IN A

216.58.213.10

content-autofill.googleapis.com

IN A

172.217.169.10

content-autofill.googleapis.com

IN A

216.58.212.234

content-autofill.googleapis.com

IN A

172.217.169.74

content-autofill.googleapis.com

IN A

142.250.179.234

content-autofill.googleapis.com

IN A

142.250.180.10
GET

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSFwmJiXZZ83LH7RIFDQwwAW8SBQ0qayak?alt=proto

chrome.exe

Remote address:

142.250.187.202:443

Request

GET /v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSFwmJiXZZ83LH7RIFDQwwAW8SBQ0qayak?alt=proto HTTP/2.0
host: content-autofill.googleapis.com
x-goog-encode-response-if-executable: base64
x-goog-api-key: AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
x-client-data: CPr2ygE=
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

202.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

202.187.250.142.in-addr.arpa

IN PTR

Response

202.187.250.142.in-addr.arpa

IN PTR

lhr25s33-in-f101e100net
DNS

202.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

202.187.250.142.in-addr.arpa

IN PTR

Response

202.187.250.142.in-addr.arpa

IN PTR

lhr25s33-in-f101e100net

104.17.29.85:443

https://m.classdojo.com/track?uid=bb031a70-7384-4878-9fd5-606acf1ada85&txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_mime_type=html&bsft_tv=25&bsft_lx=2&a=click&redir=https%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fmartynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==

tls, http2

chrome.exe

2.0kB
4.7kB
12
12

HTTP Request

GET https://m.classdojo.com/track?uid=bb031a70-7384-4878-9fd5-606acf1ada85&txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_mime_type=html&bsft_tv=25&bsft_lx=2&a=click&redir=https%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fmartynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==

HTTP Response

307
142.250.180.14:443

https://google.com/amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==?bsft_clkid=7c8321c8-6d5d-4e34-b406-380d1f1cf0e4&bsft_uid=bb031a70-7384-4878-9fd5-606acf1ada85&bsft_mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&bsft_txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_mime_type=html&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&bsft_lx=2&bsft_tv=25

tls, http2

chrome.exe

2.5kB
11.1kB
16
20

HTTP Request

GET https://google.com/amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==?bsft_clkid=7c8321c8-6d5d-4e34-b406-380d1f1cf0e4&bsft_uid=bb031a70-7384-4878-9fd5-606acf1ada85&bsft_mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&bsft_txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_mime_type=html&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&bsft_lx=2&bsft_tv=25
216.58.204.68:443

https://www.google.com/amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==?bsft_clkid=7c8321c8-6d5d-4e34-b406-380d1f1cf0e4&bsft_uid=bb031a70-7384-4878-9fd5-606acf1ada85&bsft_mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&bsft_txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_mime_type=html&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&bsft_lx=2&bsft_tv=25

tls, http2

chrome.exe

2.5kB
7.9kB
15
17

HTTP Request

GET https://www.google.com/amp/s/martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==?bsft_clkid=7c8321c8-6d5d-4e34-b406-380d1f1cf0e4&bsft_uid=bb031a70-7384-4878-9fd5-606acf1ada85&bsft_mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&bsft_txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_mime_type=html&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&bsft_lx=2&bsft_tv=25
185.184.154.65:443

https://martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==

tls, http2

chrome.exe

1.9kB
5.7kB
14
13

HTTP Request

GET https://martynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==

HTTP Response

200
185.184.154.65:443

martynpinckard.co.nz

tls

chrome.exe

1.0kB
5.1kB
10
9
96.17.179.184:80

http://apps.identrust.com/roots/dstrootcax3.p7c

http

chrome.exe

416 B
1.6kB
6
5

HTTP Request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

HTTP Response

200
188.114.97.2:443

https://jg79qpbchy.q1pethfc.ru/46Q9ZrT/

tls, http2

chrome.exe

2.1kB
18.6kB
21
27

HTTP Request

GET https://jg79qpbchy.q1pethfc.ru/46Q9ZrT/

HTTP Response

404
188.114.97.2:443

jg79qpbchy.q1pethfc.ru

tls

chrome.exe

897 B
3.9kB
7
6
35.190.80.1:443

https://a.nel.cloudflare.com/report/v3?s=lDwLR3EYiV8wv7kG9XsX9f6KoKbRo4HpzvZ77azI3DmzKJ2YrYdCA4KJPiYJun%2BUZz7VEI1YYn1YlvCuQTsyCOiBj1uG5sh8QLioa83E0tdMLa5Y2L13C37zYU5T8wRx%2FK18Oz1NpGFz

tls, http2

chrome.exe

1.8kB
6.0kB
14
15

HTTP Request

OPTIONS https://a.nel.cloudflare.com/report/v3?s=lDwLR3EYiV8wv7kG9XsX9f6KoKbRo4HpzvZ77azI3DmzKJ2YrYdCA4KJPiYJun%2BUZz7VEI1YYn1YlvCuQTsyCOiBj1uG5sh8QLioa83E0tdMLa5Y2L13C37zYU5T8wRx%2FK18Oz1NpGFz
151.101.1.229:443

https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

tls, http2

chrome.exe

2.6kB
32.8kB
32
35

HTTP Request

GET https://cdn.jsdelivr.net/npm/bootstrap@5.0.2/dist/css/bootstrap.min.css

HTTP Response

200
104.17.2.184:443

https://challenges.cloudflare.com/turnstile/v0/api.js

tls, http2

chrome.exe

1.6kB
3.3kB
11
11

HTTP Request

GET https://challenges.cloudflare.com/turnstile/v0/api.js

HTTP Response

302
216.58.213.3:443

https://beacons.gcp.gvt2.com/domainreliability/upload

tls, http2

chrome.exe

2.0kB
7.1kB
16
16

HTTP Request

POST https://beacons.gcp.gvt2.com/domainreliability/upload
142.250.187.202:443

https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSFwmJiXZZ83LH7RIFDQwwAW8SBQ0qayak?alt=proto

tls, http2

chrome.exe

1.7kB
6.9kB
12
14

HTTP Request

GET https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTA2LjAuNTI0OS4xMTkSFwmJiXZZ83LH7RIFDQwwAW8SBQ0qayak?alt=proto

8.8.8.8:53

m.classdojo.com

dns

chrome.exe

61 B
181 B
1
1

DNS Request

m.classdojo.com

DNS Response

104.17.29.85

104.17.30.85
8.8.8.8:53

85.29.17.104.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

85.29.17.104.in-addr.arpa
8.8.8.8:53

173.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

173.178.17.96.in-addr.arpa
8.8.8.8:53

google.com

dns

chrome.exe

56 B
72 B
1
1

DNS Request

google.com

DNS Response

142.250.180.14
8.8.8.8:53

183.142.211.20.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

183.142.211.20.in-addr.arpa
8.8.8.8:53

14.180.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

14.180.250.142.in-addr.arpa
8.8.8.8:53

www.google.com

dns

chrome.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

216.58.204.68
8.8.8.8:53

martynpinckard.co.nz

dns

chrome.exe

66 B
82 B
1
1

DNS Request

martynpinckard.co.nz

DNS Response

185.184.154.65
8.8.8.8:53

68.204.58.216.in-addr.arpa

dns

72 B
169 B
1
1

DNS Request

68.204.58.216.in-addr.arpa
8.8.8.8:53

apps.identrust.com

dns

chrome.exe

64 B
165 B
1
1

DNS Request

apps.identrust.com

DNS Response

96.17.179.184

96.17.179.205
8.8.8.8:53

65.154.184.185.in-addr.arpa

dns

73 B
119 B
1
1

DNS Request

65.154.184.185.in-addr.arpa
8.8.8.8:53

jg79qpbchy.q1pethfc.ru

dns

chrome.exe

68 B
100 B
1
1

DNS Request

jg79qpbchy.q1pethfc.ru

DNS Response

188.114.97.2

188.114.96.2
8.8.8.8:53

184.179.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

184.179.17.96.in-addr.arpa
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

2.97.114.188.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

2.97.114.188.in-addr.arpa
8.8.8.8:53

75.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

75.159.190.20.in-addr.arpa
8.8.8.8:53

a.nel.cloudflare.com

dns

chrome.exe

66 B
82 B
1
1

DNS Request

a.nel.cloudflare.com

DNS Response

35.190.80.1
35.190.80.1:443

a.nel.cloudflare.com

https

chrome.exe

3.8kB
5.2kB
8
9
8.8.8.8:53

cdn.jsdelivr.net

dns

chrome.exe

62 B
160 B
1
1

DNS Request

cdn.jsdelivr.net

DNS Response

151.101.1.229

151.101.65.229

151.101.129.229

151.101.193.229
8.8.8.8:53

challenges.cloudflare.com

dns

chrome.exe

71 B
103 B
1
1

DNS Request

challenges.cloudflare.com

DNS Response

104.17.2.184

104.17.3.184
104.17.2.184:443

challenges.cloudflare.com

https

chrome.exe

44.9kB
193.1kB
99
180
188.114.97.2:443

jg79qpbchy.q1pethfc.ru

https

chrome.exe

21.2kB
13.6kB
28
28
8.8.8.8:53

1.80.190.35.in-addr.arpa

dns

70 B
120 B
1
1

DNS Request

1.80.190.35.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

232.168.11.51.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

232.168.11.51.in-addr.arpa
8.8.8.8:53

184.2.17.104.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

184.2.17.104.in-addr.arpa
8.8.8.8:53

229.1.101.151.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

229.1.101.151.in-addr.arpa
8.8.8.8:53

226.21.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

226.21.18.104.in-addr.arpa
8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

178.223.142.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

178.223.142.52.in-addr.arpa
8.8.8.8:53

157.123.68.40.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

157.123.68.40.in-addr.arpa
8.8.8.8:53

56.126.166.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

56.126.166.20.in-addr.arpa
8.8.8.8:53

0.205.248.87.in-addr.arpa

dns

142 B
232 B
2
2

DNS Request

0.205.248.87.in-addr.arpa

DNS Request

0.205.248.87.in-addr.arpa
8.8.8.8:53

180.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

180.178.17.96.in-addr.arpa
35.190.80.1:443

a.nel.cloudflare.com

https

chrome.exe

2.7kB
2.4kB
9
8
8.8.8.8:53

google.com

dns

chrome.exe

112 B
144 B
2
2

DNS Request

google.com

DNS Request

google.com

DNS Response

142.250.180.14

DNS Response

142.250.180.14
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

132 B
224 B
2
2

DNS Request

beacons.gcp.gvt2.com

DNS Request

beacons.gcp.gvt2.com

DNS Response

216.58.213.3

DNS Response

192.178.49.3
142.250.180.14:443

google.com

https

chrome.exe

4.0kB
8.2kB
8
11
8.8.8.8:53

3.213.58.216.in-addr.arpa

dns

71 B
138 B
1
1

DNS Request

3.213.58.216.in-addr.arpa
8.8.8.8:53

134.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

134.32.126.40.in-addr.arpa
104.17.2.184:443

challenges.cloudflare.com

https

chrome.exe

33.0kB
6.9kB
33
20
188.114.97.2:443

jg79qpbchy.q1pethfc.ru

https

chrome.exe

17.4kB
125.1kB
73
129
8.8.8.8:53

19.229.111.52.in-addr.arpa

dns

144 B
316 B
2
2

DNS Request

19.229.111.52.in-addr.arpa

DNS Request

19.229.111.52.in-addr.arpa
8.8.8.8:53

content-autofill.googleapis.com

dns

chrome.exe

77 B
301 B
1
1

DNS Request

content-autofill.googleapis.com

DNS Response

142.250.187.202

142.250.187.234

172.217.16.234

142.250.200.42

142.250.200.10

142.250.178.10

216.58.201.106

216.58.204.74

216.58.213.10

172.217.169.10

216.58.212.234

172.217.169.74

142.250.179.234

142.250.180.10
8.8.8.8:53

202.187.250.142.in-addr.arpa

dns

148 B
226 B
2
2

DNS Request

202.187.250.142.in-addr.arpa

DNS Request

202.187.250.142.in-addr.arpa
188.114.97.2:443

jg79qpbchy.q1pethfc.ru

https

chrome.exe

14.1kB
118.3kB
64
117

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a05ccd06c9d1c34c60376ea2264245a1

SHA1
e7de8efe847c41b421ce9fd00a20510c5af3ed69

SHA256
587754fd4c1e5a3e6c067dca8a4a4580e5242b188c9be7a47b1d4e74627dba4d

SHA512
f66efa06d5b8e8ff6968961e1afc6c6744f2c7cc73a948a0eac8227bba5df83c993eec947ff0c8d336a2e9c63bdc7b9496a72b991fffad3f313b1c7731c91f3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9cffed0acd7f131b1964828acc088384

SHA1
0683e446ae721a3d241fd075f5f0e58dc72d82d7

SHA256
4af11f17f6b97dee27113500526a77cf6ec55d6ab9188f487286194c57f0ab11

SHA512
2447cade15c52c92f4942650b81d73b129ddc8203ddfeb692478274ddcfaa300893bea2745dfcbc573aa4f239e6494006172addf528685d1ec9853d83e3df400

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
01785d85ef9404fa59bf5448b708d23e

SHA1
a2f50c5318a8c5f72c260f54777d4f96ea3b4cd0

SHA256
972dd5a101ed98082f6e3593b1d0b402a5d8c1120d233e2258a522b103006bba

SHA512
737012dc99ab1d52e8e4cc7a13bf3cf382f3a7e228817b44be2627d85ce46c911f0ffcedb1c34fec21fa2664cc4a2f10f76ecbf6895699eb7cb55d69e1527517

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
986b0a0a41986f21ffc6ddd7a85b53d1

SHA1
028187942951f28ef01383ea12c49fcc79b7867e

SHA256
b98ddd8de484ae43cee37a51383e03267c07b5c29163d4a498dd69759c94ae79

SHA512
44fb6b4eeda6b58bf836d3f49af633b957f4aed9473ab293be067f70a5b89edaf894956bc1ec1bc01ae97fe147f4013b9efdc9bac6710313c0065b2ab0c5b712

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
528B

MD5
da581b671483c0a22aec0ceaec21a663

SHA1
972ad36bbb56487f922ba389ca085cabaa00e46c

SHA256
5ecc5d68ed5f74def27e134c7d8b1d8ff3cb0fe1cdcd3236005901a2fb21b8de

SHA512
de9f425b71f94dfaec7d3cdae0b9335bb94cc94fadb8bdb92c3b91b65e6cd530691fff0e2249b8910d03adce68531eb4e27f5f0335990b8e9cc84249cbbf3033

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
675ada83921ba9d747c59bafbed6943a

SHA1
1a1b1c3fb26fc7c17db99ceeec754e1e2e07fcd0

SHA256
ec0f7a38b4ccfca7c89a49573791a0eb82fe15de205c227cff6dc94b0cd395fe

SHA512
a27a380b9fe423a60d04068877dd2697ff33551a58b3ebccc80e872aca95ef669d906356b8d3901fb6c47214288d03bd8ddddaaf478387b86cb817a177ce1c07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
59e5ce90026fbdc67291f9328c18ce56

SHA1
7060c7a38f214045725ea115ff8a269b2de3c456

SHA256
dd91eefa9add3f33c60b4e893e7d5104da910a5c599c87e0a7a089f7f01fde10

SHA512
b9a0b3f3f262fdd6ff9fa045c97d2ebd075695ac23de7614be2f3059e127232fe6445957deefb32829e366ed34f9417aa763f4a240456350f75124af4fcd0505

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
e03ef126956cf680418c215f9c40f87f

SHA1
de5b4ef0211f0e7713923607ef0ad621bd20576f

SHA256
e9e3593611a115bb1dd2ff9b668ef8733707cf7233ec8f4bf1d1d812e3b1cb05

SHA512
67d17decdf58ab9b7f01dc9534e159eb458273195434ef914afb724eaa528aba9fffbd0ec46b21fe0afc71633b1d21581a1c171664e63bbdc6e4f7dab971e99a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
45cc549ebf8bc32b4c9df6c954ed081d

SHA1
407b4b21748c5b424d5e830072551cb15362efc1

SHA256
1743504934c7a0461ce98b1255fa2983d04b5db4b096f6702b0ee91925b0d812

SHA512
9893ddcfc8adb649100ce4a50d31aef3166860ef2d3476beb6cdb69234d394707378187dddefb97e6b7ce2434efd595ac696db47eb5aff39691c552ba42becd5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
114KB

MD5
8ef7bd4e9f0d147af12dc37c5f040526

SHA1
d994bffe1648cf346ff980b685fef563d42a54be

SHA256
b0ef79da8c7705feee4d0b60cbcd11aa3354c97c91f2660adbf6503e3948ea51

SHA512
2553f5f516890ea37fcbd2b4b9c60b8ed0b68fe2d9d0604bab7bd56079bbfed8a0997b05a180a954c0be81910a38df5208ce2098e2024b3553ed89eccb52a7c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Response

DNS Request

DNS Request

DNS Response

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request