hxxps://twitch[.]tubson[.]pl/

Analysis

max time kernel
300s
max time network
269s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/02/2024, 15:38 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://twitch.tubson.pl/

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
115	discord.com
120	discord.com

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528307739896272"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2398549320-3657759451-817663969-1000\{12FCDCE8-06F9-4A6A-A8D1-868C9A635A6C}	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
4912	chrome.exe
4912	chrome.exe
4588	mspaint.exe
4588	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe
Token: SeShutdownPrivilege	2232	chrome.exe
Token: SeCreatePagefilePrivilege	2232	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe
2232	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2380	CredentialUIBroker.exe
5068	CredentialUIBroker.exe
4588	mspaint.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 824	2232	chrome.exe	42
PID 2232 wrote to memory of 824	2232	chrome.exe	42
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 4260	2232	chrome.exe	87
PID 2232 wrote to memory of 3084	2232	chrome.exe	88
PID 2232 wrote to memory of 3084	2232	chrome.exe	88
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89
PID 2232 wrote to memory of 1628	2232	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://twitch.tubson.pl/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe176b9758,0x7ffe176b9768,0x7ffe176b9778
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:2
  2⤵
  PID:4260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3068 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4964 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5264 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4600 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5168 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4072 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6060 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=6768 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6788 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6780 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6668 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=6596 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=7488 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=7200 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3280 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3360 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=2528 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6624 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6992 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6828 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:3608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=1960,i,9534882271560746283,10587371849959218134,131072 /prefetch:8
  2⤵
  PID:2092

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4044

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x450 0x3e4
1⤵
PID:1776

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2380

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainer -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2828

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\miska2.jpg" /ForceBootstrapPaint3D
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4852

Network

DNS

twitch.tubson.pl

chrome.exe

Remote address:

8.8.8.8:53

Request

twitch.tubson.pl

IN A

Response

twitch.tubson.pl

IN A

104.21.31.222

twitch.tubson.pl

IN A

172.67.180.6
GET

https://twitch.tubson.pl/

chrome.exe

Remote address:

104.21.31.222:443

Request

GET / HTTP/2.0
host: twitch.tubson.pl
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Mon, 19 Feb 2024 15:39:27 GMT
content-type: text/html; charset=utf-8
last-modified: Sun, 27 Aug 2023 12:36:40 GMT
access-control-allow-origin: *
expires: Mon, 19 Feb 2024 15:38:47 GMT
cache-control: max-age=600
x-proxy-cache: MISS
x-github-request-id: 5AAE:33992E:9062E:92560:65D373AF
via: 1.1 varnish
age: 0
x-served-by: cache-lcy-eglc8600048-LCY
x-cache: HIT
x-cache-hits: 1
x-timer: S1708357168.563832,VS0,VE104
vary: Accept-Encoding
x-fastly-request-id: c042ea7d5b1d9bc2e5b5b92f1716d37f37d0267e
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KNj9XULhDoSAeI4tyfJj5Mp8HOXysBDamWpojcgMj5XfselDwtI05LMbDNe6khBiNJMm%2FhlYUBHPyNtaSyOPCfFLNPh%2Bb%2F8rWPJWTRxvnipUJ4ARt8Ptq2z0vAxD%2FktQb4EK"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 857f9a492a05885f-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://twitch.tubson.pl/index.js

chrome.exe

Remote address:

104.21.31.222:443

Request

GET /index.js HTTP/2.0
host: twitch.tubson.pl
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Mon, 19 Feb 2024 15:39:28 GMT
content-type: application/javascript; charset=utf-8
last-modified: Sun, 27 Aug 2023 12:36:40 GMT
access-control-allow-origin: *
etag: W/"64eb4358-7510"
expires: Mon, 19 Feb 2024 15:38:48 GMT
cache-control: max-age=14400
x-proxy-cache: MISS
x-github-request-id: 1796:0E35:35C9E15:36B5982:65D110C2
via: 1.1 varnish
x-served-by: cache-lcy-eglc8600073-LCY
x-cache: HIT
x-cache-hits: 1
x-timer: S1708200860.383548,VS0,VE105
vary: Accept-Encoding
x-fastly-request-id: 3e91a12751be293e6faad2db7db596eb1757a2b4
cf-cache-status: REVALIDATED
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=APP5bJHB5NNfBWI8HNk3X9ajntHmvz5QzMhUm%2F6rXWMh1%2FhfShcm4TM67mJc7T5IeO2thXSDRg1X0RsPpg4UHO9iTh%2BHKxL2t8QXmlm2nPVidenA1xpRcY0PpHxtFyjT6vtz"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 857f9a4c7f29885f-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
DNS

apps.identrust.com

chrome.exe

Remote address:

8.8.8.8:53

Request

apps.identrust.com

IN A

Response

apps.identrust.com

IN CNAME

identrust.edgesuite.net

identrust.edgesuite.net

IN CNAME

a1952.dscq.akamai.net

a1952.dscq.akamai.net

IN A

96.17.179.184

a1952.dscq.akamai.net

IN A

96.17.179.205
GET

http://apps.identrust.com/roots/dstrootcax3.p7c

chrome.exe

Remote address:

96.17.179.184:80

Request

GET /roots/dstrootcax3.p7c HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: apps.identrust.com

Response

HTTP/1.1 200 OK

X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex
Referrer-Policy: same-origin
Last-Modified: Fri, 13 Oct 2023 16:28:31 GMT
ETag: "37d-6079b8c0929c0"
Accept-Ranges: bytes
Content-Length: 893
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Type: application/pkcs7-mime
Cache-Control: max-age=3600
Expires: Mon, 19 Feb 2024 16:39:26 GMT
Date: Mon, 19 Feb 2024 15:39:26 GMT
Connection: keep-alive
DNS

222.31.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

222.31.21.104.in-addr.arpa

IN PTR

Response
DNS

14.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.160.190.20.in-addr.arpa

IN PTR

Response
DNS

static.cloudflareinsights.com

chrome.exe

Remote address:

8.8.8.8:53

Request

static.cloudflareinsights.com

IN A

Response

static.cloudflareinsights.com

IN A

104.16.57.101

static.cloudflareinsights.com

IN A

104.16.56.101
DNS

r2.e-z.host

chrome.exe

Remote address:

8.8.8.8:53

Request

r2.e-z.host

IN A

Response

r2.e-z.host

IN A

104.21.45.167

r2.e-z.host

IN A

172.67.216.169
GET

https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317

chrome.exe

Remote address:

104.16.57.101:443

Request

GET /beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317 HTTP/2.0
host: static.cloudflareinsights.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
origin: https://twitch.tubson.pl
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: script
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Mon, 19 Feb 2024 15:39:27 GMT
content-type: text/javascript;charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/"2023.10.0"
last-modified: Tue, 10 Oct 2023 21:38:13 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 857f9a4b68de63fb-LHR
content-encoding: gzip
GET

https://r2.e-z.host/f6318a01-bbaa-4a22-88a9-e5193b03d8b3/i85336vr.png

chrome.exe

Remote address:

104.21.45.167:443

Request

GET /f6318a01-bbaa-4a22-88a9-e5193b03d8b3/i85336vr.png HTTP/2.0
host: r2.e-z.host
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Mon, 19 Feb 2024 15:39:30 GMT
content-type: image/png
content-length: 1383875
etag: "74a86d902ed9c98e1d2611c71ce6ddfe"
last-modified: Sat, 26 Aug 2023 09:56:13 GMT
vary: Accept-Encoding
cache-control: max-age=1800
cf-cache-status: MISS
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uoeOedGy%2Br29DVSjrd8SjQZUqJPW3d1vof9zBNocmlgjGRytSLns5lJH3CHwbw%2FyMst6krn0p8dqryGh0ae8VOhedLR4n73PI96FPV%2BSA3mHE22L1vFoxv4YQ%2FSQcA%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 857f9a5b2fdadc25-LHR
alt-svc: h3=":443"; ma=86400
DNS

184.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

184.179.17.96.in-addr.arpa

IN PTR

Response

184.179.17.96.in-addr.arpa

IN PTR

a96-17-179-184deploystaticakamaitechnologiescom
DNS

181.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

181.178.17.96.in-addr.arpa

IN PTR

Response

181.178.17.96.in-addr.arpa

IN PTR

a96-17-178-181deploystaticakamaitechnologiescom
DNS

101.57.16.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

101.57.16.104.in-addr.arpa

IN PTR

Response
DNS

167.45.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

167.45.21.104.in-addr.arpa

IN PTR

Response
DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR

Response
DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR
DNS

228.249.119.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.249.119.40.in-addr.arpa

IN PTR
DNS

232.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.179.250.142.in-addr.arpa

IN PTR

Response

232.179.250.142.in-addr.arpa

IN PTR

lhr25s31-in-f81e100net
DNS

region1.google-analytics.com

chrome.exe

Remote address:

8.8.8.8:53

Request

region1.google-analytics.com

IN A

Response

region1.google-analytics.com

IN A

216.239.34.36

region1.google-analytics.com

IN A

216.239.32.36
DNS

234.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.187.250.142.in-addr.arpa

IN PTR

Response

234.187.250.142.in-addr.arpa

IN PTR

lhr25s34-in-f101e100net
POST

https://region1.google-analytics.com/g/collect?v=2&tid=G-6S5388LRGM&gtm=45je42e0v9137156704za200&_p=1708357166576&gcd=13l3l3l3l1&npa=0&dma=0&cid=547248687.1708357168&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1708357168&sct=1&seg=0&dl=https%3A%2F%2Ftwitch.tubson.pl%2F&dt=Twitch&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4913

chrome.exe

Remote address:

216.239.34.36:443

Request

POST /g/collect?v=2&tid=G-6S5388LRGM&gtm=45je42e0v9137156704za200&_p=1708357166576&gcd=13l3l3l3l1&npa=0&dma=0&cid=547248687.1708357168&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1708357168&sct=1&seg=0&dl=https%3A%2F%2Ftwitch.tubson.pl%2F&dt=Twitch&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4913 HTTP/2.0
host: region1.google-analytics.com
content-length: 0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: */*
origin: https://twitch.tubson.pl
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

36.34.239.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

36.34.239.216.in-addr.arpa

IN PTR

Response
DNS

a.nel.cloudflare.com

chrome.exe

Remote address:

8.8.8.8:53

Request

a.nel.cloudflare.com

IN A

Response

a.nel.cloudflare.com

IN A

35.190.80.1
OPTIONS

https://a.nel.cloudflare.com/report/v3?s=q1OnZgQoha5y2HPNWiZRdabg%2FRjDg8s%2B%2Bju9uxypWLaM%2FSovX1T9VzUKIqlSAcd9f%2BBiQNd7Hg4hiy0ZoBXyTMbSBCeeXK1RF92OEoUOZj1Hi2k3wHGTRi1UhFsI%2FDHa6Y%2B5

chrome.exe

Remote address:

35.190.80.1:443

Request

OPTIONS /report/v3?s=q1OnZgQoha5y2HPNWiZRdabg%2FRjDg8s%2B%2Bju9uxypWLaM%2FSovX1T9VzUKIqlSAcd9f%2BBiQNd7Hg4hiy0ZoBXyTMbSBCeeXK1RF92OEoUOZj1Hi2k3wHGTRi1UhFsI%2FDHa6Y%2B5 HTTP/2.0
host: a.nel.cloudflare.com
origin: https://twitch.tubson.pl
access-control-request-method: POST
access-control-request-headers: content-type
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
OPTIONS

https://a.nel.cloudflare.com/report/v3?s=KbT0rw9TetvePc6NFc5Deedoe0puF%2Blo5QNOqtoABmfi%2FHSo%2BU2%2FfJO37iAKDTHYyOt2yMZdk5kRBZIHioU2iSdnZ2hcyJWtzg14ox6QMGRDzHvbMwCmZ2uI3fWJ

chrome.exe

Remote address:

35.190.80.1:443

Request

OPTIONS /report/v3?s=KbT0rw9TetvePc6NFc5Deedoe0puF%2Blo5QNOqtoABmfi%2FHSo%2BU2%2FfJO37iAKDTHYyOt2yMZdk5kRBZIHioU2iSdnZ2hcyJWtzg14ox6QMGRDzHvbMwCmZ2uI3fWJ HTTP/2.0
host: a.nel.cloudflare.com
origin: https://discord.com
access-control-request-method: POST
access-control-request-headers: content-type
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
OPTIONS

https://a.nel.cloudflare.com/report/v3?s=%2BRYrDzBIhAoTIjTMDxI5I5hZ7cS%2Fq6w5%2F42yjnvzJghVtwEG9excCvn0lqYk08OFm89La%2FH5NGiyfk0Fkyg4NjjL93h7IH2%2BHAokr%2F5UJepLpjOumXJZBSOxLpX9jH5bzw%3D%3D

chrome.exe

Remote address:

35.190.80.1:443

Request

OPTIONS /report/v3?s=%2BRYrDzBIhAoTIjTMDxI5I5hZ7cS%2Fq6w5%2F42yjnvzJghVtwEG9excCvn0lqYk08OFm89La%2FH5NGiyfk0Fkyg4NjjL93h7IH2%2BHAokr%2F5UJepLpjOumXJZBSOxLpX9jH5bzw%3D%3D HTTP/2.0
host: a.nel.cloudflare.com
origin: https://jshop.partners
access-control-request-method: POST
access-control-request-headers: content-type
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

1.80.190.35.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.80.190.35.in-addr.arpa

IN PTR

Response

1.80.190.35.in-addr.arpa

IN PTR

18019035bcgoogleusercontentcom
DNS

140.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

140.32.126.40.in-addr.arpa

IN PTR

Response
DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.178.4
GET

https://www.google.com/async/ddljson?async=ntp:2

chrome.exe

Remote address:

142.250.178.4:443

Request

GET /async/ddljson?async=ntp:2 HTTP/2.0
host: www.google.com
sec-fetch-site: none
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

chrome.exe

Remote address:

142.250.178.4:443

Request

GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/2.0
host: www.google.com
x-client-data: CNLuygE=
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.google.com/async/newtab_promos

chrome.exe

Remote address:

142.250.178.4:443

Request

GET /async/newtab_promos HTTP/2.0
host: www.google.com
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: empty
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

4.178.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

4.178.250.142.in-addr.arpa

IN PTR

Response

4.178.250.142.in-addr.arpa

IN PTR

lhr48s27-in-f41e100net
DNS

4.178.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

4.178.250.142.in-addr.arpa

IN PTR
DNS

97.17.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.17.167.52.in-addr.arpa

IN PTR

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

217.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.135.221.88.in-addr.arpa

IN PTR

Response

217.135.221.88.in-addr.arpa

IN PTR

a88-221-135-217deploystaticakamaitechnologiescom
DNS

81.171.91.138.in-addr.arpa

Remote address:

8.8.8.8:53

Request

81.171.91.138.in-addr.arpa

IN PTR

Response
DNS

www.amazon.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.amazon.com

IN A

Response

www.amazon.com

IN CNAME

tp.47cf2c8c9-frontier.amazon.com

tp.47cf2c8c9-frontier.amazon.com

IN CNAME

d3ag4hukkh62yn.cloudfront.net

d3ag4hukkh62yn.cloudfront.net

IN A

52.222.148.112
DNS

www.amazon.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.amazon.com

IN A

Response

www.amazon.com

IN CNAME

tp.47cf2c8c9-frontier.amazon.com

tp.47cf2c8c9-frontier.amazon.com

IN CNAME

d3ag4hukkh62yn.cloudfront.net

d3ag4hukkh62yn.cloudfront.net

IN A

52.222.148.112
DNS

www.amazon.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.amazon.com

IN A

Response

www.amazon.com

IN CNAME

tp.47cf2c8c9-frontier.amazon.com

tp.47cf2c8c9-frontier.amazon.com

IN CNAME

d3ag4hukkh62yn.cloudfront.net

d3ag4hukkh62yn.cloudfront.net

IN A

52.222.148.112
DNS

www.dropbox.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.dropbox.com

IN A

Response

www.dropbox.com

IN CNAME

www-env.dropbox-dns.com

www-env.dropbox-dns.com

IN A

162.125.65.18
DNS

www.dropbox.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.dropbox.com

IN A

Response

www.dropbox.com

IN CNAME

www-env.dropbox-dns.com

www-env.dropbox-dns.com

IN A

162.125.65.18
DNS

signin.ebay.com

chrome.exe

Remote address:

8.8.8.8:53

Request

signin.ebay.com

IN A

Response

signin.ebay.com

IN CNAME

slot9430.ebay.com.edgekey.net

slot9430.ebay.com.edgekey.net

IN CNAME

e9430.a.akamaiedge.net

e9430.a.akamaiedge.net

IN A

104.84.81.174
GET

https://signin.ebay.com/ws/eBayISAPI.dll?SignIn

chrome.exe

Remote address:

104.84.81.174:443

Request

GET /ws/eBayISAPI.dll?SignIn HTTP/2.0
host: signin.ebay.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
accept-ch: sec-ch-ua-model,sec-ch-ua-platform-version,sec-ch-ua-full-version
content-security-policy-report-only: connect-src 'self' *.ebay.com *.ebay.co.uk *.ebaystatic.com *.ebaystatic.co.uk data: *.quantummetric.com *.googlesyndication.com wss://127.0.0.1:* *.amplitude.com *.gstatic.com *.doubleclick.net *.ravelin.click *.ravelin.com *.ebay-us.com *.cloudfront.net *.bluekai.com *.forter.com *.google-analytics.com *.perfdrive.com *.google.com blob: *.akamaihd.net *.googleapis.com *.analytics.google.com *.ebayrtm.com *.ucweb.com *.trongrid.io *.glance.net *.facebook.net *.puretheweb.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' blob: data: *.ebay.com *.ebay.co.uk *.ebaystatic.com *.ebaystatic.co.uk *.googlesyndication.com *.ebaystatic.cn *.ebay-us.com *.forter.com *.paypal.com *.ebayrtm.com *.quantummetric.com *.doubleclick.net *.cloudfront.net *.googletagservices.com *.google-analytics.com *.ucweb.com *.googletagmanager.com *.akamaihd.net *.fidoapi.com *.google.com *.cloudflare.com *.facebook.net *.googleapis.com edge: puffin: brave:; upgrade-insecure-requests; frame-ancestors 'self' *.ebay.com *.ebay.co.uk; default-src 'self' 'unsafe-inline' blob: data: wss: mediastream: *.ebay.com *.ebay.co.uk *.ebaystatic.com *.ebaystatic.co.uk *.forter.com *.paypal.com *.gstatic.com *.ebayimg.com *.ebayrtm.com *.googlesyndication.com wss://127.0.0.1:* *.ebay-us.com *.cloudfront.net *.google-analytics.com *.online-metrix.net *.google.com *.doubleclick.net *.bluekai.com *.fontawesome.com *.googleusercontent.com *.bootstrapcdn.com *.cloudflare.com *.googletagmanager.com *.akamaihd.net *.googleapis.com *.ucweb.com *.facebook.net *.reich-web.com *.auctiva.com *.ebaystatic.cn *.puretheweb.com; report-uri https://monitor.ebay.com/csp-report/sgninui/SigninLegacyView?id=188664998644566661&rid=t6pbhnmpo%3D9vjdpbhnmpo*a%3Ctls(rbpv6775-18dc2068e61-0x1804#pd
content-type: text/html; charset=utf-8
x-frame-options: SAMEORIGIN
rlogid: t6pbhnmpo%3D9vjdpbhnmpo*a%3Ctls(rbpv6775-18dc2068e61-0x1804
vary: Accept-Encoding
x-envoy-upstream-service-time: 132
server: ebay-proxy-server
strict-transport-security: max-age=31536000
x-ebay-pop-id: SLBLVSAZ04
content-encoding: gzip
expires: Mon, 19 Feb 2024 15:40:26 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Mon, 19 Feb 2024 15:40:26 GMT
content-length: 33863
set-cookie: dp1=bu1p/QEBfX0BAX19AQA**6995dd6a^pbf/%232000000000000000000000000000467b4a9ea^tzo/1a465d3847a^bl/GB6995dd6a^; Domain=.ebay.com; Path=/; Expires=Wed, 18 Feb 2026 15:40:26 GMT; Secure
set-cookie: nonsession=BAQAAAYxL36hOAAaAADMAB2e0qepFQzRSMEFOAMoAIGmV3WpjMjA2OGU3MDE4ZDBhNDRlMTE0ZjA4Y2FmZWI4YWIwMQDLAAFl031yMUV1VYlOQRlCunFqgw2uzXgCck8M; Domain=.ebay.com; Path=/; Expires=Wed, 18 Feb 2026 15:40:26 GMT; HttpOnly; Secure
set-cookie: s=CgAD4ACBl1MfqYzIwNjhlNzAxOGQwYTQ0ZTExNGYwOGNhZmViOGFiMDEODMk0; Domain=.ebay.com; Path=/; HttpOnly; Secure
set-cookie: ebay=%5Ejs%3D1%5Esbf%3D%23000000%5E; Domain=.ebay.com; Path=/; Secure
set-cookie: cid=2kCmw5W8J9u2SKqF%23920088315; Domain=.ebay.com; Path=/; Expires=Tue, 18 Feb 2025 15:40:26 GMT; HttpOnly; Secure
set-cookie: __deba=vLyzgT-gCTxzKrMvTXuHS90MUqsRM1DqXFMUTL4EhFV-eILNFYyIog6Vc6mrcNaoXR8UW1J2_XMwSXzXGqPFGOevgaczmxgztM8gN8_d33xpfIOWlXe0dc-dmAadT7DaNasoGMTIAXCuSaaxGoSV2A==; HttpOnly; Secure; Path=/; Domain=.ebay.com; Expires=Sat, 17 Aug 2024 15:40:26 UTC
set-cookie: __uzma=3f6d620e-9dd1-430a-9cb1-18ab60ea3f97; Path=/; Domain=.ebay.com; Expires=Sat, 17 Aug 2024 15:40:26 UTC
set-cookie: __uzmb=1708357226; Path=/; Domain=.ebay.com; Expires=Sat, 17 Aug 2024 15:40:26 UTC
set-cookie: __uzmc=877941019847; Path=/; Domain=.ebay.com; Expires=Sat, 17 Aug 2024 15:40:26 UTC
set-cookie: __uzmd=1708357226; Path=/; Domain=.ebay.com; Expires=Sat, 17 Aug 2024 15:40:26 UTC
set-cookie: __uzme=3247; Path=/; Domain=.ebay.com; Expires=Sat, 17 Aug 2024 15:40:26 UTC
set-cookie: __uzmf=7f60005fdac514-8d8b-4173-b944-d705194d22c517083572260780-92a6229ce0613a2110; Path=/; Domain=.ebay.com; Expires=Sat, 17 Aug 2024 15:40:26 UTC
set-cookie: ak_bmsc=CAAE051D66735BC567DCB8BC0B2EF739~000000000000000000000000000000~YAAQnYfdWMCnNLONAQAAHo8GwhZEHtPQkU7VrrnTITt4aYjK1xdGFHZ0Gn3nqxoMkPYhAcVAzFxuI6p6cyA+Sx/74GKPRgGskaO1uW6Je+JadRtSSqVs2/eYQwlUqI6YmGoNLwsD7PA5wvVnw3mSujNPCCq6acCcJIjxOAEXy5f+Rm6XPJ9lnCZpx4zFKYaA+tVM6wv1QxxrBKTqeFlL7FH1nK3WtLOxXXI2m/QnyVWxSRo8Cza5CqoqR4GvbvUchP9koH/eCO7Dkgl2tzN4XKk1cw7N1XLpFbwOK42/0vBYpUDsVUw4hK2Ms6+5Jb1Cz7pLm4bc0WUURZpq82VE3Jrpat1i6RBONYCNJ4FUBvcUoxumDOSA9s6fm7GmmFqS6bCr/sL72w==; Domain=.ebay.com; Path=/; Expires=Mon, 19 Feb 2024 17:40:25 GMT; Max-Age=7199; HttpOnly
DNS

github.com

chrome.exe

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

140.82.121.3
DNS

github.com

chrome.exe

Remote address:

8.8.8.8:53

Request

github.com

IN A

Response

github.com

IN A

140.82.121.4
DNS

mail.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

mail.google.com

IN A

Response

mail.google.com

IN A

172.217.16.229
GET

https://www.amazon.com/gp/flex/sign-out.html?action=sign-out

chrome.exe

Remote address:

52.222.148.112:443

Request

GET /gp/flex/sign-out.html?action=sign-out HTTP/2.0
host: www.amazon.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 302

content-length: 0
location: https://www.amazon.com/ap/signin?openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2Fap%2Fsignin%3Fopenid.pape.max_auth_age%3D900%26openid.return_to%3Dhttps%253A%252F%252Fwww.amazon.com%253Faction%253Dsign-out%26openid.assoc_handle%3Dusflex%26openid.mode%3Dcheckid_setup%26openid.ns%3Dhttp%253A%252F%252Fspecs.openid.net%252Fauth%252F2.0&openid.assoc_handle=usflex&openid.mode=logout&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
server: Server
date: Mon, 19 Feb 2024 15:40:16 GMT
x-amz-rid: C5A7P8JE5SPJ0J6VQNBQ
set-cookie: session-id=136-2785521-9603568; Domain=.amazon.com; Expires=Tue, 01 Jan 2036 08:00:01 GMT; Path=/
set-cookie: session-id-time=2082787201l; Domain=.amazon.com; Expires=Tue, 01 Jan 2036 08:00:01 GMT; Path=/
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache
cache-control: no-store
content-language: en-US
strict-transport-security: max-age=47474747; includeSubDomains; preload
vary: Content-Type,Accept-Encoding,User-Agent
x-frame-options: SAMEORIGIN
x-cache: Miss from cloudfront
via: 1.1 786b0e4c2382030de0f64ed48e56b4bc.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG52-P1
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 5Pn4uaIhR31FY_AfPvu_QWWwKxW74-THjKA65UX4kfAx5629oLyhow==
DNS

secure.hulu.com

chrome.exe

Remote address:

8.8.8.8:53

Request

secure.hulu.com

IN A

Response

secure.hulu.com

IN CNAME

wildcard-dual.hulu.com.edgekey.net

wildcard-dual.hulu.com.edgekey.net

IN CNAME

e91869.dsca.akamaiedge.net

e91869.dsca.akamaiedge.net

IN A

23.48.165.145
DNS

www.netflix.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.netflix.com

IN A

Response

www.netflix.com

IN CNAME

www.dradis.netflix.com

www.dradis.netflix.com

IN CNAME

www.eu-west-1.internal.dradis.netflix.com

www.eu-west-1.internal.dradis.netflix.com

IN CNAME

apiproxy-website-nlb-prod-1-5675d5ecda6efdd8.elb.eu-west-1.amazonaws.com

apiproxy-website-nlb-prod-1-5675d5ecda6efdd8.elb.eu-west-1.amazonaws.com

IN A

52.214.181.141

apiproxy-website-nlb-prod-1-5675d5ecda6efdd8.elb.eu-west-1.amazonaws.com

IN A

54.170.196.176

apiproxy-website-nlb-prod-1-5675d5ecda6efdd8.elb.eu-west-1.amazonaws.com

IN A

54.246.79.9
DNS

www.netflix.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.netflix.com

IN A

Response

www.netflix.com

IN CNAME

www.dradis.netflix.com

www.dradis.netflix.com

IN CNAME

www.eu-west-1.internal.dradis.netflix.com

www.eu-west-1.internal.dradis.netflix.com

IN CNAME

apiproxy-website-nlb-prod-3-ac110f6ae472b85a.elb.eu-west-1.amazonaws.com

apiproxy-website-nlb-prod-3-ac110f6ae472b85a.elb.eu-west-1.amazonaws.com

IN A

54.155.178.5

apiproxy-website-nlb-prod-3-ac110f6ae472b85a.elb.eu-west-1.amazonaws.com

IN A

54.74.73.31

apiproxy-website-nlb-prod-3-ac110f6ae472b85a.elb.eu-west-1.amazonaws.com

IN A

3.251.50.149
GET

https://mail.google.com/mail/?logout

chrome.exe

Remote address:

172.217.16.229:443

Request

GET /mail/?logout HTTP/2.0
host: mail.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://mail.google.com/mail/?logout&view

chrome.exe

Remote address:

172.217.16.229:443

Request

GET /mail/?logout&view HTTP/2.0
host: mail.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://mail.google.com/mail/logout?hl=en-US

chrome.exe

Remote address:

172.217.16.229:443

Request

GET /mail/logout?hl=en-US HTTP/2.0
host: mail.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://mail.google.com/mail

chrome.exe

Remote address:

172.217.16.229:443

Request

GET /mail HTTP/2.0
host: mail.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

secure.skype.com

chrome.exe

Remote address:

8.8.8.8:53

Request

secure.skype.com

IN A

Response

secure.skype.com

IN CNAME

secure.skype-apps.akadns.net

secure.skype-apps.akadns.net

IN A

52.178.182.128
GET

https://secure.skype.com/account/logout

chrome.exe

Remote address:

52.178.182.128:443

Request

GET /account/logout HTTP/1.1
Host: secure.skype.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://twitch.tubson.pl/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 302 Found

Server: nginx
Date: Mon, 19 Feb 2024 15:40:16 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Set-Cookie: skypetoken=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly
Set-Cookie: signinName=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly
Set-Cookie: login_state=9f2d96db08dcaa75e3f6c80f; path=/; secure; HttpOnly
X-Stratus-Processing-Time: 0.0049
X-Skype-Request-Id: fb971994
X-Stratus-Request-Id: fb971994
P3P: CP="CAO PSA OUR"
Location: https://login.skype.com/logout?client_id=360605&redirect_uri=https%3A%2F%2Fsecure.skype.com%2Fportal%2Flogin&response_type=postgrant&state=9f2d96db08dcaa75e3f6c80f
Vary: Origin
Content-Security-Policy-Report-Only: connect-src https://*.clarity.ms https://browser.events.data.microsoft.com https://web.vortex.data.microsoft.com https://browser.pipe.aria.microsoft.com https://uhf.microsoft.com https://api.skype.com https://a.config.skype.com https://b.config.skype.com https://apps.skypeassets.com https://secure.skype.com https://manager.skype.com https://contacts.skype.com https://edge.skype.com https://config.edge.skype.com https://api.promotions.skype.com https://sso.skypetoken.skype.com https://register.greenid.skype.com https://www.facebook.com https://api.asm.skype.com https://options.skype.com https://login.microsoftonline.com https://displaycatalog.mp.microsoft.com; font-src https://apps.skypeassets.com https://secure.skypeassets.com https://www.microsoft.com https://c.s-microsoft.com data: https://fonts.gstatic.com; form-action https://secure.skype.com https://manager.skype.com https://live.adyen.com https://www.facebook.com https://connect.facebook.net https://www.microsoft.com; frame-src https://secure.skype.com https://manager.skype.com https://login.live.com https://a.lw.skype.com https://fpt.skype.com https://pay.skype.com https://cap.attempts.securecode.com https://live.adyen.com https://www.facebook.com https://connect.facebook.net https://vcas1.visa.com https://aacsw.3ds.verifiedbyvisa.com https://authentication.cardinalcommerce.com https://secure.payu.in https://www.microsoft.com https://login.microsoftonline.com; img-src https://apps.skypeassets.com https://secure.skypeassets.com https://static-asm.secure.skypeassets.com https://avatar.skype.com https://manager.skype.com https://img-prod-cms-rt-microsoft-com.akamaized.net https://uhf.microsoft.com https://web.vortex.data.microsoft.com https://logincdn.msauth.net data: https://www.facebook.com https://ad.doubleclick.net https://adservice.google.com https://adservice.google.co.uk https://adservice.google.co.in https://adservice.google.co.jp https://www.google.co.uk https://adservice.google.ca https://googleads.g.doubleclick.net https://www.google.com; script-src https://www.clarity.ms https://js.monitor.azure.com https://wcpstatic.microsoft.com https://apps.skypeassets.com https://secure.skypeassets.com https://az725175.vo.msecnd.net https://web.vortex.data.microsoft.com https://c.s-microsoft.com https://www.microsoft.com https://www.googleadservices.com https://connect.facebook.net https://cdnssl.clicktale.net 'unsafe-inline'; style-src https://apps.skypeassets.com https://secure.skypeassets.com https://c.s-microsoft.com https://www.microsoft.com https://statics-marketingsites-eus-ms-com.akamaized.net https://statics-marketingsites-neu-ms-com.akamaized.net https://statics-marketingsites-wcus-ms-com.akamaized.net https://statics-marketingsites-eas-ms-com.akamaized.net 'unsafe-inline'; default-src 'none'; base-uri 'none'; object-src 'none'; block-all-mixed-content; report-uri https://edge.skype.com/r/c
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Processing-Time: 0.010
DNS

soundcloud.com

chrome.exe

Remote address:

8.8.8.8:53

Request

soundcloud.com

IN A

Response

soundcloud.com

IN A

18.155.129.6

soundcloud.com

IN A

18.155.129.112

soundcloud.com

IN A

18.155.129.19

soundcloud.com

IN A

18.155.129.12
DNS

steamcommunity.com

chrome.exe

Remote address:

8.8.8.8:53

Request

steamcommunity.com

IN A

Response

steamcommunity.com

IN A

23.214.154.77
GET

https://www.netflix.com/Logout

chrome.exe

Remote address:

52.214.181.141:443

Request

GET /Logout HTTP/2.0
host: www.netflix.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://github.com/logout

chrome.exe

Remote address:

140.82.121.3:443

Request

GET /logout HTTP/2.0
host: github.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 302

server: GitHub.com
date: Mon, 19 Feb 2024 15:40:18 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
location: https://github.com/
cache-control: no-cache
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
set-cookie: _gh_sess=e2Snrms4NIASvfgDw%2BhQAE8kGdGmzRmwTI9aUOvlttwGDwT%2Fs32ocJJ3ELk7Xc8KUWVbF8TR2i8CM2DHzHyufJ8SiDAqIunF8bvi528SCeY%2BtxubW58p310c%2Bc3AJq6w2F3E%2FGEHNb%2BlTdirOIcEvGERGsumr9tgR%2BuQKtSjGmZMjSVCSoukbecK1GoDl5ktdD0IofuMRwokNGxvUffOQKc8uHArfn6GbHrTPbXUQDHKaQD98IWzoVVrtJV56LhrPG5fhVlxIBXg0vLQBLLQvw%3D%3D--Ry6Y8fj40Fhb2Zz3--WnU7hBahzqh3hFU04YZ9Bw%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.427222001.1708357217; Path=/; Domain=github.com; Expires=Wed, 19 Feb 2025 15:40:17 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Wed, 19 Feb 2025 15:40:17 GMT; HttpOnly; Secure; SameSite=Lax
content-length: 0
x-github-request-id: DA1F:24426E:38604A:38FA98:65D37661
GET

https://github.com/

chrome.exe

Remote address:

140.82.121.3:443

Request

GET / HTTP/2.0
host: github.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

server: GitHub.com
date: Mon, 19 Feb 2024 15:40:21 GMT
content-type: text/html; charset=utf-8
vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Language, Accept-Encoding, Accept, X-Requested-With
content-language: en-US
etag: W/"c9b05ac68f5a05aa78f544406da9a78f"
cache-control: max-age=0, private, must-revalidate
strict-transport-security: max-age=31536000; includeSubdomains; preload
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 0
referrer-policy: origin-when-cross-origin, strict-origin-when-cross-origin
content-security-policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com github.githubassets.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
content-encoding: gzip
set-cookie: _gh_sess=FEw9eYuvP3Zj7vAXxHMVln5OcP0AeQ1eF9vB2vCl6eFjww8SwEIK4pRcR%2FO90zFi7p307pfUL0ngntpqnEh9UYsa6ZVzlfpp0tdK7M%2FjGuelFyxBXwtI%2Bg9qAObMcJbHaH8BKhJ3xKrfcJpY%2B%2FAYCFifvJmJfvVkQDWJFfS%2FG2mRZngGaSS1LyIUP%2Bdx%2FOaDoj0MfoYkJT033I6HlRqMm5OP3O1NgQz4kuKx50nNgq64I8cGyZrNszaU2%2BAhyWdUNJw0dYnj6sX8dMu5UUG4tA%3D%3D--YLKPrj%2FJ5bcTwqyV--RIH98V1jKs71NXVKShbxoQ%3D%3D; Path=/; HttpOnly; Secure; SameSite=Lax
set-cookie: _octo=GH1.1.1461641356.1708357221; Path=/; Domain=github.com; Expires=Wed, 19 Feb 2025 15:40:21 GMT; Secure; SameSite=Lax
set-cookie: logged_in=no; Path=/; Domain=github.com; Expires=Wed, 19 Feb 2025 15:40:21 GMT; HttpOnly; Secure; SameSite=Lax
accept-ranges: bytes
x-github-request-id: DA1F:24426E:38798C:3913FE:65D37662
GET

https://secure.hulu.com/logout

chrome.exe

Remote address:

23.48.165.145:443

Request

GET /logout HTTP/1.1
Host: secure.hulu.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://twitch.tubson.pl/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 302 Moved Temporarily

Content-Type: text/html; charset=utf-8
Content-Length: 33
Server: envoy
Vary: Origin
Location: /
Content-Security-Policy: upgrade-insecure-requests; frame-ancestors 'self' http://*.hulu.com https://*.hulu.com;
strict-transport-security: max-age=31536000
x-frame-options: DENY
Expires: Mon, 19 Feb 2024 15:40:21 GMT
Cache-Control: no-cache
x-envoy-upstream-service-time: 7
x-diproton-route: Envoy
Date: Mon, 19 Feb 2024 15:40:22 GMT
Connection: keep-alive
Set-Cookie: ADFHA=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=.hulu.com
Set-Cookie: ADFHA=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT; domain=.hulu.com
Vary: Origin
Set-Cookie: ak_bmsc=064564850184A70555B8B1ACB3F8DA4F~000000000000000000000000000000~YAAQkbEXAna35LqNAQAAvX4GwhaCpXJHBJohrlcArYNY7rn4h2xfKP2NHF2I/NAr3fgBrdNh8h9LXY3NwiZBya+pGes7CC5hiuEfMSCBfZoDhlGn7b8BLqgjdRQZQdjl5LIaCY4fMWnx9lc/fZ0DivoaYtU6Dlj/GMTWDGV01NPD6Tds6yjg6BRelPixpxlaH6qys2Iz7wggKoI4We2IHpoo5mekjbOOqau2VrXqA3SoE7LDb5MR6JnWsSFdhkWYRIXho0OdPe29l9IgolIGVF8kJciGBTiIJYBDUn3UyoZJG/KaSGzzxa//dZS/Hn6GCMnKCOGnfpJ3vnu3pDEE9SQg8ac9pqoKeDQZXzachm8zKCnGJT+OFHFhB80W; Domain=.hulu.com; Path=/; Expires=Mon, 19 Feb 2024 17:40:21 GMT; Max-Age=7199; HttpOnly
GET

https://secure.hulu.com/

chrome.exe

Remote address:

23.48.165.145:443

Request

GET / HTTP/1.1
Host: secure.hulu.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://twitch.tubson.pl/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 166
Server: envoy
Location: https://www.hulu.com/
Content-Security-Policy: upgrade-insecure-requests; frame-ancestors 'self' http://*.hulu.com https://*.hulu.com;
strict-transport-security: max-age=31536000
x-frame-options: DENY
x-envoy-upstream-service-time: 1
x-diproton-route: Envoy
Date: Mon, 19 Feb 2024 15:40:26 GMT
Connection: keep-alive
Vary: Origin
Set-Cookie: ak_bmsc=81F20103C30F40139CBEFABEBC33D787~000000000000000000000000000000~YAAQkbEXAsC65LqNAQAAho4GwhZlMyYQGzYfYZZPxD3/SA1/cgixfdvhzoQEsKyXa0X3ZVtEyYSRSTnOAw23Cf6zW2L6E9awbD8a8f1gOLRD40RpinO0JSu0he+zRnVcnqHTH19m/pEjUjrWVk/OWIRjMl7WyiItuJYtHfG12ZOU0w+4+HJL6KXRrhSCnKnKkqgbSLy65btQmImdQYGPjRf/uHHyWbbKkva9sygr4OShDBTSIcand6D1cCSKFtE9O38SGvMZoKlva/9eh39M/H3gPfkgrly8YmNds5Y/QA8vU+JRa/0LIlOy8ACbl/3GxOHonEzJZXSAmSBVUNAYP3Jjd1/c+zc6zERzPfDpOw6921ElfgzvrVkOJJXS; Domain=.hulu.com; Path=/; Expires=Mon, 19 Feb 2024 17:40:26 GMT; Max-Age=7200; HttpOnly
DNS

discord.com

chrome.exe

Remote address:

8.8.8.8:53

Request

discord.com

IN A

Response

discord.com

IN A

162.159.137.232

discord.com

IN A

162.159.138.232

discord.com

IN A

162.159.128.233

discord.com

IN A

162.159.135.232

discord.com

IN A

162.159.136.232
DNS

www.deviantart.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.deviantart.com

IN A

Response

www.deviantart.com

IN A

52.222.201.85

www.deviantart.com

IN A

52.222.201.23

www.deviantart.com

IN A

52.222.201.47

www.deviantart.com

IN A

52.222.201.76
DNS

www.youtube.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.youtube.com

IN A

Response

www.youtube.com

IN CNAME

youtube-ui.l.google.com

youtube-ui.l.google.com

IN A

172.217.169.78

youtube-ui.l.google.com

IN A

142.250.179.238

youtube-ui.l.google.com

IN A

142.250.180.14

youtube-ui.l.google.com

IN A

142.250.187.206

youtube-ui.l.google.com

IN A

142.250.187.238

youtube-ui.l.google.com

IN A

172.217.16.238

youtube-ui.l.google.com

IN A

142.250.178.14

youtube-ui.l.google.com

IN A

142.250.200.46

youtube-ui.l.google.com

IN A

142.250.200.14

youtube-ui.l.google.com

IN A

216.58.201.110

youtube-ui.l.google.com

IN A

216.58.204.78
POST

https://www.youtube.com/

chrome.exe

Remote address:

172.217.169.78:443

Request

POST / HTTP/2.0
host: www.youtube.com
content-length: 15
cache-control: max-age=0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
origin: https://twitch.tubson.pl
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
POST

https://www.deviantart.com/users/logout

chrome.exe

Remote address:

52.222.201.85:443

Request

POST /users/logout HTTP/2.0
host: www.deviantart.com
content-length: 0
cache-control: max-age=0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
origin: https://twitch.tubson.pl
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 302

content-type: text/html; charset=ISO-8859-1
content-length: 0
location: https://www.deviantart.com
date: Mon, 19 Feb 2024 15:40:26 GMT
server: Apache
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa OUR STP"
set-cookie: userinfo=__fc26c011f16b85c8384d%3B%7B%22username%22%3A%22%22%2C%22uniqueid%22%3A%22f34f22fca8a5697f9752660b8a6dde2c%22%2C%22dvs9-1%22%3A1%2C%22ab%22%3A%22tao-me1-1-a-1%7Ctao-uma-1-b-4%7Ctao-12c-1-a-10%7Ctao-ot1-1-a-4%22%7D; expires=Wed, 20-Mar-2024 15:40:26 GMT; Max-Age=2592000; path=/; domain=.deviantart.com; SameSite=Lax
x-backend: web_http_back
x-cache: Miss from cloudfront
via: 1.1 ee4db0d243ceb0d1993e5f46ad6c0f00.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P2
x-amz-cf-id: Vm_NxKjtCYqa-8ViOZ7n9ujM-fLAcRbABfVly47IzEKz6y8o0LzuRQ==
GET

https://www.deviantart.com/

chrome.exe

Remote address:

52.222.201.85:443

Request

GET / HTTP/2.0
host: www.deviantart.com
cache-control: max-age=0
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/html; charset=utf-8
date: Mon, 19 Feb 2024 15:40:30 GMT
cross-origin-opener-policy: same-origin-allow-popups
origin-agent-cluster: ?1
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=5184000; includeSubDomains
x-content-type-options: nosniff
x-dns-prefetch-control: off
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
content-security-policy: object-src wixmp-ed30a86b8c4ca887773594c2.wixmp.com wixmp-395331243bc2089e8c09c8d3.wixmp.com img-deviantart.wixmp.com;script-src 'nonce-d272a69fc3c9839938dfa2e272830756' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https: http: ;base-uri 'none';frame-ancestors 'self' sta.sh;upgrade-insecure-requests;block-all-mixed-content
accept-ch: Sec-CH-Viewport-Width, Sec-CH-Viewport-Height
accept-ch-lifetime: 86400
content-language: en
set-cookie: userinfo=__66a5e15335564638f724%3B%7B%22username%22%3A%22%22%2C%22uniqueid%22%3A%22aa4c29053ed772755d382f5dbb223f60%22%2C%22dvs9-1%22%3A1%2C%22ab%22%3A%22tao-me1-1-b-6%7Ctao-uma-1-a-4%7Ctao-12c-1-b-2%7Ctao-ot1-1-a-3%22%7D; expires=Wed, 20-Mar-2024 15:40:30 GMT; Max-Age=2592000; path=/; domain=.deviantart.com; SameSite=Lax
cache-control: no-cache
da-sr: u
content-encoding: br
server-timing: p;dur=377.78270899970084, r;dur=62.447817999869585, o;dur=25.568589000962675, t;dur=465.7991160005331
x-seen-by:
x-backend: da_browse_back
x-cache: Miss from cloudfront
via: 1.1 ee4db0d243ceb0d1993e5f46ad6c0f00.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG50-P2
x-amz-cf-id: JyAP2nxsFYPyYoXCgItqZ5fKwhMGCECKqgsf_xrgIHtY4WufP0e4ag==
POST

https://discord.com/api/v9/auth/logout

chrome.exe

Remote address:

162.159.137.232:443

Request

POST /api/v9/auth/logout HTTP/2.0
host: discord.com
content-length: 24
cache-control: max-age=0
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
upgrade-insecure-requests: 1
origin: https://twitch.tubson.pl
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 401

date: Mon, 19 Feb 2024 15:40:18 GMT
content-type: application/json
content-length: 43
set-cookie: __dcfduid=2f501564cf3d11eea06efe561da7504d; Expires=Sat, 17-Feb-2029 15:40:18 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
access-control-allow-origin: https://twitch.tubson.pl
access-control-allow-credentials: true
access-control-allow-methods: POST, GET, PUT, PATCH, DELETE
access-control-allow-headers: Content-Type, Authorization, X-Audit-Log-Reason, X-Track, X-Super-Properties, X-Context-Properties, X-Failed-Requests, X-Fingerprint, X-RPC-Proxy, X-Discord-Locale, X-Discord-Timezone, X-Debug-Options, x-client-trace-id, If-None-Match, X-Captcha-Key, X-Captcha-Rqtoken, X-Discord-MFA-Authorization, Range, X-RateLimit-Precision
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KbT0rw9TetvePc6NFc5Deedoe0puF%2Blo5QNOqtoABmfi%2FHSo%2BU2%2FfJO37iAKDTHYyOt2yMZdk5kRBZIHioU2iSdnZ2hcyJWtzg14ox6QMGRDzHvbMwCmZ2uI3fWJ"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'none'; default-src 'none'
set-cookie: __sdcfduid=2f501564cf3d11eea06efe561da7504d2e3b55f7fcfc148eb08b306e4f103294218581bc3f8fb0d84852e470c59e4f65; Expires=Sat, 17-Feb-2029 15:40:18 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
set-cookie: __cfruid=0b2e06c6906fe9b3bb34610088c5b4c744197217-1708357218; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
set-cookie: _cfuvid=MV6FhuGPM2cgZAHqV6sf6PjrL7W7R7gTsgaPck1pT9k-1708357218927-0.0-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
server: cloudflare
cf-ray: 857f9b897eac63db-LHR
GET

https://soundcloud.com/logout

chrome.exe

Remote address:

18.155.129.6:443

Request

GET /logout HTTP/2.0
host: soundcloud.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 401

content-type: text/html
content-length: 17755
x-pants: distant-towel
x-xss-protection: 1; mode=block
cache-control: private, max-age=0, no-cache, no-store
x-frame-options: SAMEORIGIN
server-timing: enabledFeatures; dur=8.739901; desc="api-v2/enabledFeatures", experiments; dur=7.610284; desc="api-v2/experiments", geoip; dur=1.140495; desc="geoip/geoip", privacySettings; dur=6.047593; desc="api-v2/privacySettings"
date: Mon, 19 Feb 2024 15:40:31 GMT
strict-transport-security: max-age=63072000; includeSubdomains; preload
server: am/2
x-cache: Error from cloudfront
via: 1.1 c812f87630e842766e842cb048d8c94e.cloudfront.net (CloudFront)
x-amz-cf-pop: CDG52-P4
x-amz-cf-id: gU2WGBeC1qzpy64A9INsFcfhjFIsCAp4qLh-EdzF3z4zXGlVSJTWTQ==
GET

https://steamcommunity.com/?action=doLogout

chrome.exe

Remote address:

23.214.154.77:443

Request

GET /?action=doLogout HTTP/1.1
Host: steamcommunity.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://twitch.tubson.pl/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: text/html; charset=UTF-8
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060 https://steamvideo-a.akamaihd.net/; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://steamloopback.host ;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 8661
Date: Mon, 19 Feb 2024 15:40:19 GMT
Connection: keep-alive
Set-Cookie: sessionid=68d10e1e22037d41dff89022; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C40c16361ca649cf81f15d6fdb49b4f01; Path=/; Secure; HttpOnly; SameSite=None
DNS

store.steampowered.com

chrome.exe

Remote address:

8.8.8.8:53

Request

store.steampowered.com

IN A

Response

store.steampowered.com

IN A

104.78.177.128
DNS

store.steampowered.com

chrome.exe

Remote address:

8.8.8.8:53

Request

store.steampowered.com

IN A

Response

store.steampowered.com

IN A

104.78.177.128
GET

https://store.steampowered.com/logout/

chrome.exe

Remote address:

104.78.177.128:443

Request

GET /logout/ HTTP/1.1
Host: store.steampowered.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://twitch.tubson.pl/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 302 Moved Temporarily

Server: nginx
Content-Type: text/html; charset=UTF-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://store.cloudflare.steamstatic.com/ https://store.cloudflare.steamstatic.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' http://store.steampowered.com https://store.steampowered.com http://127.0.0.1:27060 ws://127.0.0.1:27060 https://community.cloudflare.steamstatic.com/ https://steamcommunity.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://shared.cloudflare.steamstatic.com/ https://checkout.steampowered.com/ https://store.steampowered.com/; frame-src 'self' steam: http://www.youtube.com https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://steamcommunity.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/ https://steamcommunity.com/ https://help.steampowered.com/;
Location: https://store.steampowered.com/
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=10368000
Content-Length: 20
Date: Mon, 19 Feb 2024 15:40:19 GMT
Connection: keep-alive
Set-Cookie: steamCountry=GB%7C40c16361ca649cf81f15d6fdb49b4f01; Path=/; Secure; HttpOnly; SameSite=None
Set-Cookie: LKGBillingCountry=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
GET

https://store.steampowered.com/

chrome.exe

Remote address:

104.78.177.128:443

Request

GET / HTTP/1.1
Host: store.steampowered.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://twitch.tubson.pl/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Cookie: steamCountry=GB%7C40c16361ca649cf81f15d6fdb49b4f01

Response

HTTP/1.1 200 OK

Server: nginx
Content-Type: text/html; charset=UTF-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://store.cloudflare.steamstatic.com/ https://store.cloudflare.steamstatic.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' http://store.steampowered.com https://store.steampowered.com http://127.0.0.1:27060 ws://127.0.0.1:27060 https://community.cloudflare.steamstatic.com/ https://steamcommunity.com/ https://steamcommunity.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://shared.cloudflare.steamstatic.com/ https://checkout.steampowered.com/; frame-src 'self' steam: http://www.youtube.com https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://steamcommunity.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'none';
X-Frame-Options: DENY
Content-Encoding: gzip
Vary: Accept-Encoding
Strict-Transport-Security: max-age=10368000
Content-Length: 81746
Date: Mon, 19 Feb 2024 15:40:25 GMT
Connection: keep-alive
Set-Cookie: sessionid=53df642d9b5986a364c25560; Path=/; Secure; SameSite=None
DNS

accounts.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

accounts.google.com

IN A

Response

accounts.google.com

IN A

142.250.27.84
DNS

accounts.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

accounts.google.com

IN A

Response

accounts.google.com

IN A

142.250.27.84
GET

https://accounts.google.com/Logout

chrome.exe

Remote address:

142.250.27.84:443

Request

GET /Logout HTTP/2.0
host: accounts.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://accounts.google.com/ServiceLogin?elo=1

chrome.exe

Remote address:

142.250.27.84:443

Request

GET /ServiceLogin?elo=1 HTTP/2.0
host: accounts.google.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

229.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

229.16.217.172.in-addr.arpa

IN PTR

Response

229.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f51e100net

229.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f5�H
DNS

174.81.84.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

174.81.84.104.in-addr.arpa

IN PTR

Response

174.81.84.104.in-addr.arpa

IN PTR

a104-84-81-174deploystaticakamaitechnologiescom
DNS

18.65.125.162.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.65.125.162.in-addr.arpa

IN PTR

Response
DNS

112.148.222.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

112.148.222.52.in-addr.arpa

IN PTR

Response

112.148.222.52.in-addr.arpa

IN PTR

server-52-222-148-112cdg52r cloudfrontnet
DNS

128.182.178.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

128.182.178.52.in-addr.arpa

IN PTR

Response
DNS

145.165.48.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.165.48.23.in-addr.arpa

IN PTR

Response

145.165.48.23.in-addr.arpa

IN PTR

a23-48-165-145deploystaticakamaitechnologiescom
DNS

145.165.48.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

145.165.48.23.in-addr.arpa

IN PTR

Response

145.165.48.23.in-addr.arpa

IN PTR

a23-48-165-145deploystaticakamaitechnologiescom
DNS

3.121.82.140.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.121.82.140.in-addr.arpa

IN PTR

Response

3.121.82.140.in-addr.arpa

IN PTR

lb-140-82-121-3-fragithubcom
DNS

141.181.214.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

141.181.214.52.in-addr.arpa

IN PTR

Response

141.181.214.52.in-addr.arpa

IN PTR

ec2-52-214-181-141 eu-west-1compute amazonawscom
DNS

141.181.214.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

141.181.214.52.in-addr.arpa

IN PTR

Response

141.181.214.52.in-addr.arpa

IN PTR

ec2-52-214-181-141 eu-west-1compute amazonawscom
DNS

78.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

78.169.217.172.in-addr.arpa

IN PTR

Response

78.169.217.172.in-addr.arpa

IN PTR

lhr48s09-in-f141e100net
DNS

85.201.222.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

85.201.222.52.in-addr.arpa

IN PTR

Response

85.201.222.52.in-addr.arpa

IN PTR

server-52-222-201-85cdg50r cloudfrontnet
DNS

6.129.155.18.in-addr.arpa

Remote address:

8.8.8.8:53

Request

6.129.155.18.in-addr.arpa

IN PTR

Response

6.129.155.18.in-addr.arpa

IN PTR

server-18-155-129-6cdg52r cloudfrontnet
DNS

77.154.214.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

77.154.214.23.in-addr.arpa

IN PTR

Response

77.154.214.23.in-addr.arpa

IN PTR

a23-214-154-77deploystaticakamaitechnologiescom
DNS

login.skype.com

chrome.exe

Remote address:

8.8.8.8:53

Request

login.skype.com

IN A

Response

login.skype.com

IN CNAME

login.skype-apps.akadns.net

login.skype-apps.akadns.net

IN A

51.105.176.200
DNS

login.skype.com

chrome.exe

Remote address:

8.8.8.8:53

Request

login.skype.com

IN A

Response

login.skype.com

IN CNAME

login.skype-apps.akadns.net

login.skype-apps.akadns.net

IN A

51.105.176.200
GET

https://login.skype.com/logout?client_id=360605&redirect_uri=https%3A%2F%2Fsecure.skype.com%2Fportal%2Flogin&response_type=postgrant&state=9f2d96db08dcaa75e3f6c80f

chrome.exe

Remote address:

51.105.176.200:443

Request

GET /logout?client_id=360605&redirect_uri=https%3A%2F%2Fsecure.skype.com%2Fportal%2Flogin&response_type=postgrant&state=9f2d96db08dcaa75e3f6c80f HTTP/1.1
Host: login.skype.com
Connection: keep-alive
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: no-cors
Sec-Fetch-Dest: image
Referer: https://twitch.tubson.pl/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 302 Found

Server: nginx
Date: Mon, 19 Feb 2024 15:40:25 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Set-Cookie: skplet=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.skype.com
X-Stratus-Processing-Time: 0.0054
X-Skype-Request-Id: 5fb5823b
X-Stratus-Request-Id: 5fb5823b
Pragma: no-cache
Cache-Control: no-store, no-cache, must-revalidate
Expires: Thu, 01 Jan 1970 00:00:01 +0000
P3P: CP="CAO PSA OUR"
Location: https://login.live.com/logout.srf?ct=1708357225&rver=7.5.2156.0&lc=1033&id=287688&ru=https%3A%2F%2Flogin.skype.com%2Flogin%3Fclient_id%3D360605%26redirect_uri%3Dhttps%253A%252F%252Fsecure.skype.com%252Fportal%252Flogin%26response_type%3Dpostgrant%26state%3D9f2d96db08dcaa75e3f6c80f%26message%3Dlogged_out&mkt=en-US&psi=skype&lw=1&cobrandid=2befc4b5-19e3-46e8-8347-77317a16a5a5&client_flight=ReservedFlight33%2CReservedFlight67
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Processing-Time: 0.008
DNS

232.137.159.162.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.137.159.162.in-addr.arpa

IN PTR

Response
DNS

84.27.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

84.27.250.142.in-addr.arpa

IN PTR

Response

84.27.250.142.in-addr.arpa

IN PTR

ra-in-f841e100net
DNS

84.27.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

84.27.250.142.in-addr.arpa

IN PTR

Response

84.27.250.142.in-addr.arpa

IN PTR

ra-in-f841e100net
DNS

128.177.78.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

128.177.78.104.in-addr.arpa

IN PTR

Response

128.177.78.104.in-addr.arpa

IN PTR

a104-78-177-128deploystaticakamaitechnologiescom
DNS

200.176.105.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.176.105.51.in-addr.arpa

IN PTR

Response
DNS

200.176.105.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

200.176.105.51.in-addr.arpa

IN PTR

Response
DNS

en.wikipedia.org

chrome.exe

Remote address:

8.8.8.8:53

Request

en.wikipedia.org

IN A

Response

en.wikipedia.org

IN CNAME

dyna.wikimedia.org

dyna.wikimedia.org

IN A

185.15.59.224
DNS

en.wikipedia.org

chrome.exe

Remote address:

8.8.8.8:53

Request

en.wikipedia.org

IN A

Response

en.wikipedia.org

IN CNAME

dyna.wikimedia.org

dyna.wikimedia.org

IN A

185.15.59.224
GET

https://en.wikipedia.org/w/index.php?title=Special:UserLogout

chrome.exe

Remote address:

185.15.59.224:443

Request

GET /w/index.php?title=Special:UserLogout HTTP/2.0
host: en.wikipedia.org
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Mon, 19 Feb 2024 15:40:26 GMT
server: mw1353.eqiad.wmnet
x-content-type-options: nosniff
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Form-Factor, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
content-language: en
x-frame-options: DENY
vary: Accept-Encoding,Cookie
expires: Thu, 01 Jan 1970 00:00:00 GMT
content-type: text/html; charset=UTF-8
content-encoding: gzip
age: 0
x-cache: cp3070 miss, cp3070 pass
x-cache-status: pass
server-timing: cache;desc="pass", host;desc="cp3070"
strict-transport-security: max-age=106384710; includeSubDomains; preload
report-to: { "group": "wm_nel", "max_age": 604800, "endpoints": [{ "url": "https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=/w3c/reportingapi/network_error/1.0.0" }] }
nel: { "report_to": "wm_nel", "max_age": 604800, "failure_fraction": 0.05, "success_fraction": 0.0}
set-cookie: WMF-Last-Access=19-Feb-2024;Path=/;HttpOnly;secure;Expires=Fri, 22 Mar 2024 12:00:00 GMT
set-cookie: WMF-Last-Access-Global=19-Feb-2024;Path=/;Domain=.wikipedia.org;HttpOnly;secure;Expires=Fri, 22 Mar 2024 12:00:00 GMT
x-client-ip: 89.149.23.59
cache-control: private, s-maxage=0, max-age=0, must-revalidate
set-cookie: GeoIP=GB:ENG:London:51.51:-0.12:v4; Path=/; secure; Domain=.wikipedia.org
set-cookie: NetworkProbeLimit=0.001;Path=/;Secure;Max-Age=3600
accept-ranges: bytes
DNS

51.201.222.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

51.201.222.52.in-addr.arpa

IN PTR

Response

51.201.222.52.in-addr.arpa

IN PTR

server-52-222-201-51cdg50r cloudfrontnet
DNS

23.149.64.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

23.149.64.172.in-addr.arpa

IN PTR

Response
DNS

23.149.64.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

23.149.64.172.in-addr.arpa

IN PTR

Response
DNS

wordpress.com

chrome.exe

Remote address:

8.8.8.8:53

Request

wordpress.com

IN A

Response

wordpress.com

IN A

192.0.78.9

wordpress.com

IN A

192.0.78.17
GET

https://wordpress.com/wp-login.php?action=logout

chrome.exe

Remote address:

192.0.78.9:443

Request

GET /wp-login.php?action=logout HTTP/2.0
host: wordpress.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 403

server: nginx
date: Mon, 19 Feb 2024 15:40:30 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding
x-hacker: Want root? Visit join.a8c.com/hacker and mention this header.
host-header: WordPress.com
vary: accept, content-type
set-cookie: wordpress_test_cookie=WP%20Cookie%20check; path=/; domain=.wordpress.com; secure
x-frame-options: SAMEORIGIN
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-encoding: br
x-ac: 1.lhr _dfw BYPASS
strict-transport-security: max-age=31536000; preload
alt-svc: h3=":443"; ma=86400
DNS

224.59.15.185.in-addr.arpa

Remote address:

8.8.8.8:53

Request

224.59.15.185.in-addr.arpa

IN PTR

Response

224.59.15.185.in-addr.arpa

IN PTR

text-lbesams wikimediaorg
DNS

67.204.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.204.58.216.in-addr.arpa

IN PTR

Response

67.204.58.216.in-addr.arpa

IN PTR

lhr48s49-in-f31e100net

67.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f3�G

67.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f67�G
DNS

67.204.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.204.58.216.in-addr.arpa

IN PTR

Response

67.204.58.216.in-addr.arpa

IN PTR

lhr48s49-in-f31e100net

67.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f67�G

67.204.58.216.in-addr.arpa

IN PTR

lhr25s13-in-f3�G
DNS

226.21.18.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

226.21.18.104.in-addr.arpa

IN PTR

Response
DNS

login.yahoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

login.yahoo.com

IN A

Response

login.yahoo.com

IN CNAME

ds-ats.member.g02.yahoodns.net

ds-ats.member.g02.yahoodns.net

IN A

212.82.100.140
DNS

login.yahoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

login.yahoo.com

IN A

Response

login.yahoo.com

IN CNAME

ds-ats.member.g02.yahoodns.net

ds-ats.member.g02.yahoodns.net

IN A

212.82.100.140
DNS

jshop.partners

chrome.exe

Remote address:

8.8.8.8:53

Request

jshop.partners

IN A

Response

jshop.partners

IN A

104.21.13.212

jshop.partners

IN A

172.67.133.31
DNS

9.78.0.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.78.0.192.in-addr.arpa

IN PTR

Response
DNS

9.78.0.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.78.0.192.in-addr.arpa

IN PTR

Response
DNS

73.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.159.190.20.in-addr.arpa

IN PTR

Response
GET

https://jshop.partners/panel/logout

chrome.exe

Remote address:

104.21.13.212:443

Request

GET /panel/logout HTTP/2.0
host: jshop.partners
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 403

date: Mon, 19 Feb 2024 15:40:31 GMT
content-type: text/html; charset=UTF-8
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
cross-origin-embedder-policy: require-corp
cross-origin-opener-policy: same-origin
cross-origin-resource-policy: same-origin
origin-agent-cluster: ?1
permissions-policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
referrer-policy: same-origin
x-frame-options: SAMEORIGIN
cf-mitigated: challenge
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BRYrDzBIhAoTIjTMDxI5I5hZ7cS%2Fq6w5%2F42yjnvzJghVtwEG9excCvn0lqYk08OFm89La%2FH5NGiyfk0Fkyg4NjjL93h7IH2%2BHAokr%2F5UJepLpjOumXJZBSOxLpX9jH5bzw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 857f9bd84c187314-LHR
content-encoding: br
alt-svc: h3=":443"; ma=86400
GET

https://login.yahoo.com/config/login?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/

chrome.exe

Remote address:

212.82.100.140:443

Request

GET /config/login?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/ HTTP/2.0
host: login.yahoo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://login.yahoo.com/?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/

chrome.exe

Remote address:

212.82.100.140:443

Request

GET /?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/ HTTP/2.0
host: login.yahoo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://login.yahoo.com/account/logout?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/

chrome.exe

Remote address:

212.82.100.140:443

Request

GET /account/logout?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/ HTTP/2.0
host: login.yahoo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

212.13.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

212.13.21.104.in-addr.arpa

IN PTR

Response
DNS

212.13.21.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

212.13.21.104.in-addr.arpa

IN PTR

Response
DNS

140.100.82.212.in-addr.arpa

Remote address:

8.8.8.8:53

Request

140.100.82.212.in-addr.arpa

IN PTR

Response

140.100.82.212.in-addr.arpa

IN PTR

ats2membervipir2yahoocom
DNS

140.100.82.212.in-addr.arpa

Remote address:

8.8.8.8:53

Request

140.100.82.212.in-addr.arpa

IN PTR

Response

140.100.82.212.in-addr.arpa

IN PTR

ats2membervipir2yahoocom
DNS

www.hulu.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.hulu.com

IN A

Response

www.hulu.com

IN CNAME

wildcard.hulu.com.edgekey.net

wildcard.hulu.com.edgekey.net

IN CNAME

e91869.a.akamaiedge.net

e91869.a.akamaiedge.net

IN A

23.48.165.145

e91869.a.akamaiedge.net

IN A

23.48.165.135
DNS

www.hulu.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.hulu.com

IN A

Response

www.hulu.com

IN CNAME

wildcard.hulu.com.edgekey.net

wildcard.hulu.com.edgekey.net

IN CNAME

e91869.a.akamaiedge.net

e91869.a.akamaiedge.net

IN A

23.48.165.145

e91869.a.akamaiedge.net

IN A

23.48.165.135
GET

https://www.hulu.com/

chrome.exe

Remote address:

23.48.165.145:443

Request

GET / HTTP/2.0
host: www.hulu.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 302

content-type: text/html
content-length: 142
server: envoy
location: https://www.hulu.com/welcome?orig_referrer=https%3A%2F%2Ftwitch.tubson.pl%2F
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' http://*.hulu.com https://*.hulu.com;
strict-transport-security: max-age=31536000
x-frame-options: DENY
x-envoy-upstream-service-time: 1
x-diproton-route: Envoy
expires: Mon, 19 Feb 2024 15:40:33 GMT
cache-control: max-age=0, no-cache, no-store
pragma: no-cache
date: Mon, 19 Feb 2024 15:40:33 GMT
vary: Origin
set-cookie: ak_bmsc=21785423906DC301D3DFC2D070943730~000000000000000000000000000000~YAAQkbEXAoa/5LqNAQAAhqwGwhbyb/PzHq9klt6FiThWfKSKzhi1J8M9gyVfNVhTS7AJmV5Ee9ZrHXx8wiYqbIqo+IeqeRSWgdAC7cy4zmgm5C6G2CoSUYI4v1ys4L6Io9aqR/ATeIouEjuT45phWN+syC9zucA/wfzw+vjoenxChiPnAc3iPPaoYVeomaQBG+H2qAf0tLQmOBKfU1BP0m6wGHlEBqBByr8hBIqyAJp9Lq0UzDjnFNUuAF0s0I790tjuzap4E/d8X4z1Y0MLNpkLlqGkPQtiOYhwsm8blsXJvv+da4e9uJgpBnl4tOyFmJjkxds8VqSLd9GPPuzLmGUY8kEaL0FAq9zDvJzwbGpw8pfdv7cABJ1+eT+sPX86AZQyx2ATiA==; Domain=.hulu.com; Path=/; Expires=Mon, 19 Feb 2024 17:40:33 GMT; Max-Age=7200; HttpOnly
GET

https://www.hulu.com/welcome?orig_referrer=https%3A%2F%2Ftwitch.tubson.pl%2F

chrome.exe

Remote address:

23.48.165.145:443

Request

GET /welcome?orig_referrer=https%3A%2F%2Ftwitch.tubson.pl%2F HTTP/2.0
host: www.hulu.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/html; charset=utf-8
server: envoy
x-datadog-trace-id: 7627050057414180009
x-datadog-parent-id: 8098538945870109249
x-datadog-sampled: 1
x-datadog-sampling-priority: 0
cache-control: max-age=0,no-store,no-cache
etag: W/"35ac5-X8gT2iawmEb4VdMRmuJy+Xx99wY"
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' http://*.hulu.com https://*.hulu.com;
strict-transport-security: max-age=31536000
x-frame-options: DENY
x-envoy-upstream-service-time: 79
x-diproton-route: Envoy
x-akamai-transformed: 9 45753 0 pmb=mTOE,2
content-encoding: gzip
date: Mon, 19 Feb 2024 15:40:39 GMT
content-length: 38325
vary: Accept-Encoding
set-cookie: _hulu_at=eyJhbGciOiJSUzI1NiJ9.eyJhc3NpZ25tZW50cyI6ImV5SjJNU0k2VzExOSIsInJlZnJlc2hfaW50ZXJ2YWwiOjg2NDAwMDAwLCJ0b2tlbl9pZCI6IjlhZjgzNzQwLTljM2YtNDhjYy05NDY3LTIyN2ZlM2NmZmMyYSIsImFub255bW91c19pZCI6ImY3OTk3NGE1LWY4OTUtNDY1MC1iMDRmLTFmNWQ4YTFhMzg3YyIsImlzc3VlZF9hdCI6MTcwODM1NzIzODc4OCwidHRsIjozMTUzNjAwMDAwMCwiZGV2aWNlX3VwcGVyIjoxfQ.nwz5RJjBucBn_HbwXrYCWGAGvlLq0KuiLeaML4Sl2BJeYDe2HweQqvVZbapnh8v9Tn4uUqsIi72nvGTh-FK-G13zl2tZeWFToHsmVAIiRYAFjo-_uo7InVBNANAqovDysSh_ri2vsywJ8xjiYrwWApcin6YsshAjf3ka-DkcjbesLgJS4f9YzkFgnu536hOmOkPcfuurUtZIurDYdi68DIKq-qcfomHrb4T36dVdIX7RUV_EbEWqrUb8Yipa4gPRYDRCGS3Ut4t66X7Rrx8QKlhWoWYe016sROomdWUFqlguKpGPwm0QVOZU6HurJgdTmUY4snSz2d88ZnH05Tdg1g;Path=/;Domain=.hulu.com;Expires=Tue, 18-Feb-2025 15:40:38 GMT;Max-Age=31536000;Secure
set-cookie: _hulu_assignments=eyJ2MSI6W119;Path=/;Domain=.hulu.com;Expires=Tue, 18-Feb-2025 15:40:38 GMT;Max-Age=31536000;Secure
vary: Origin
set-cookie: ak_bmsc=FE7A1B0766B85F1EEE0ACEE54AEC08A9~000000000000000000000000000000~YAAQkbEXAu3C5LqNAQAACcEGwhY4dVxfcykHpQzPVpFWzoXgUot7jSwgqlZcEO/WoWzbYigDYeoqj/6hKitf1m3ET9S4LGqu9T+i7lbs/AuXMCM+EDMUlZ8KlQg+IaRwzzohIimTzq5OD6TUaq48nwExtlRD+AM2AvKuq3vaUAu8i8wDWPX6hNn+asp0rGHF8wNdeJCOzcSMbUJRV+WcT2m9AJaZca/v7MK+rk0zcEZJE6eHt2/9Qh3qdCpDybqjjtTVVgXLy4p3N0c+gapYHIfoevHzk06snWBKPosCO9CUeCVOupvUvvq/Yj4JNa3Cg55/cNDzcsnEiN1FyTvsdamM2o6cqsyZQrmXKGOymJ4ADWLV5WPPNzJS6jf5TzA9/h8AS5Z+Pw==; Domain=.hulu.com; Path=/; Expires=Mon, 19 Feb 2024 17:40:38 GMT; Max-Age=7199; HttpOnly
set-cookie: bm_mi=8289DCBDDCD3FDDE86FDA0E55991F66A~YAAQkbEXAu7C5LqNAQAACcEGwhZSLz+LyeXT1ooON7ior/MtDIhtn8flY4p0emGEPBRSZ9BwGaSQctUT0MaipQ723JjOCODfI+Md51mzWEXQh/0u+EBklyIfRvJD2H3Xdn+q6SvCc/VVWwjuMNVpF0se97THFtdUADJSDFcQX/VO6EX0LuIztVlOIEtX0bHpxGOLPFq+64PMDDiPiVQSXcrbQoOe72AB5FinawyEW4Wy8RkzdMwh4oVeV4FGNwfSZMcx9k8k9He+YbweRxtjE5Pc8DX0l4TbzZg1C7MD7r6+A2Irw803RZrKRmMjMfn0rg==~1; Domain=.hulu.com; Path=/; Expires=Mon, 19 Feb 2024 15:40:39 GMT; Max-Age=0; Secure
DNS

182.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

182.178.17.96.in-addr.arpa

IN PTR

Response

182.178.17.96.in-addr.arpa

IN PTR

a96-17-178-182deploystaticakamaitechnologiescom
DNS

182.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

182.178.17.96.in-addr.arpa

IN PTR

Response

182.178.17.96.in-addr.arpa

IN PTR

a96-17-178-182deploystaticakamaitechnologiescom
DNS

www.yahoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.yahoo.com

IN A

Response

www.yahoo.com

IN CNAME

me-ycpi-cf-www.g06.yahoodns.net

me-ycpi-cf-www.g06.yahoodns.net

IN A

87.248.114.12

me-ycpi-cf-www.g06.yahoodns.net

IN A

87.248.114.11
DNS

www.yahoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.yahoo.com

IN A

Response

www.yahoo.com

IN CNAME

me-ycpi-cf-www.g06.yahoodns.net

me-ycpi-cf-www.g06.yahoodns.net

IN A

87.248.114.12

me-ycpi-cf-www.g06.yahoodns.net

IN A

87.248.114.11
DNS

www.yahoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.yahoo.com

IN A

Response

www.yahoo.com

IN CNAME

me-ycpi-cf-www.g06.yahoodns.net

me-ycpi-cf-www.g06.yahoodns.net

IN A

87.248.114.12

me-ycpi-cf-www.g06.yahoodns.net

IN A

87.248.114.11
GET

https://www.yahoo.com/

chrome.exe

Remote address:

87.248.114.12:443

Request

GET / HTTP/2.0
host: www.yahoo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://uk.yahoo.com/?p=us

chrome.exe

Remote address:

87.248.114.12:443

Request

GET /?p=us HTTP/2.0
host: uk.yahoo.com
sec-ch-ua: "Chromium";v="106", "Google Chrome";v="106", "Not;A=Brand";v="99"
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
sec-ch-ua-platform: "Windows"
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://twitch.tubson.pl/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: A3=d=AQABBIR202UCEKjyP8qiRYqs9_ienxaxrmsFEgABAf-51GXcZc50rXYBAAAAgA&S=AQAAAhA_NpN0ogu4VCwyq4i1LNg
DNS

12.114.248.87.in-addr.arpa

Remote address:

8.8.8.8:53

Request

12.114.248.87.in-addr.arpa

IN PTR

Response

12.114.248.87.in-addr.arpa

IN PTR

e2ycpiviplobyahoocom
DNS

beacons.gcp.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons.gcp.gvt2.com

IN A

Response

beacons.gcp.gvt2.com

IN CNAME

beacons-handoff.gcp.gvt2.com

beacons-handoff.gcp.gvt2.com

IN A

172.217.169.67
POST

https://beacons.gcp.gvt2.com/domainreliability/upload

chrome.exe

Remote address:

172.217.169.67:443

Request

POST /domainreliability/upload HTTP/2.0
host: beacons.gcp.gvt2.com
content-length: 2124
content-type: application/json; charset=utf-8
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

67.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.169.217.172.in-addr.arpa

IN PTR

Response

67.169.217.172.in-addr.arpa

IN PTR

lhr48s09-in-f31e100net
DNS

11.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

11.227.111.52.in-addr.arpa

IN PTR

Response
DNS

180.178.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

180.178.17.96.in-addr.arpa

IN PTR

Response

180.178.17.96.in-addr.arpa

IN PTR

a96-17-178-180deploystaticakamaitechnologiescom
GET

http://www.gstatic.com/generate_204

chrome.exe

Remote address:

172.217.169.3:80

Request

GET /generate_204 HTTP/1.1
Host: www.gstatic.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 204 No Content

Content-Length: 0
Cross-Origin-Resource-Policy: cross-origin
Date: Mon, 19 Feb 2024 15:41:15 GMT
DNS

3.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.169.217.172.in-addr.arpa

IN PTR

Response

3.169.217.172.in-addr.arpa

IN PTR

lhr25s26-in-f31e100net
DNS

79.121.231.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

79.121.231.20.in-addr.arpa

IN PTR

Response
DNS

csp.withgoogle.com

chrome.exe

Remote address:

8.8.8.8:53

Request

csp.withgoogle.com

IN A

Response

csp.withgoogle.com

IN A

172.217.169.81
OPTIONS

https://csp.withgoogle.com/csp/report-to/gws/cdt1

chrome.exe

Remote address:

172.217.169.81:443

Request

OPTIONS /csp/report-to/gws/cdt1 HTTP/2.0
host: csp.withgoogle.com
origin: https://www.google.com
access-control-request-method: POST
access-control-request-headers: content-type
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

81.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

81.169.217.172.in-addr.arpa

IN PTR

Response

81.169.217.172.in-addr.arpa

IN PTR

lhr48s09-in-f171e100net
DNS

122.10.44.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

122.10.44.20.in-addr.arpa

IN PTR

Response
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.178.4
DNS

www.google.com

chrome.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.178.4
DNS

uk.yahoo.com

chrome.exe

Remote address:

8.8.8.8:53

Request

uk.yahoo.com

IN A

Response

uk.yahoo.com

IN CNAME

fp-ycpi.g03.yahoodns.net

fp-ycpi.g03.yahoodns.net

IN A

87.248.114.12

fp-ycpi.g03.yahoodns.net

IN A

87.248.114.11
DNS

beacons4.gvt2.com

chrome.exe

Remote address:

8.8.8.8:53

Request

beacons4.gvt2.com

IN A

Response

beacons4.gvt2.com

IN A

216.239.32.116
OPTIONS

https://beacons4.gvt2.com/domainreliability/upload-nel

chrome.exe

Remote address:

216.239.32.116:443

Request

OPTIONS /domainreliability/upload-nel HTTP/2.0
host: beacons4.gvt2.com
origin: https://beacons.gcp.gvt2.com
access-control-request-method: POST
access-control-request-headers: content-type
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

116.32.239.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

116.32.239.216.in-addr.arpa

IN PTR

Response

116.32.239.216.in-addr.arpa

IN PTR

e2agooglecom
DNS

116.32.239.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

116.32.239.216.in-addr.arpa

IN PTR

Response

116.32.239.216.in-addr.arpa

IN PTR

e2agooglecom

52.142.223.178:80

52 B
1
104.21.31.222:443

twitch.tubson.pl

tls, http2

chrome.exe

1.5kB
1.2kB
15
7
104.21.31.222:443

https://twitch.tubson.pl/index.js

tls, http2

chrome.exe

3.4kB
20.4kB
33
38

HTTP Request

GET https://twitch.tubson.pl/

HTTP Response

200

HTTP Request

GET https://twitch.tubson.pl/index.js

HTTP Response

200
96.17.179.184:80

http://apps.identrust.com/roots/dstrootcax3.p7c

http

chrome.exe

468 B
1.6kB
7
5

HTTP Request

GET http://apps.identrust.com/roots/dstrootcax3.p7c

HTTP Response

200
104.16.57.101:443

https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317

tls, http2

chrome.exe

2.1kB
11.0kB
21
23

HTTP Request

GET https://static.cloudflareinsights.com/beacon.min.js/v84a3a4012de94ce1a686ba8c167c359c1696973893317

HTTP Response

200
104.21.45.167:443

https://r2.e-z.host/f6318a01-bbaa-4a22-88a9-e5193b03d8b3/i85336vr.png

tls, http2

chrome.exe

56.9kB
1.5MB
894
1078

HTTP Request

GET https://r2.e-z.host/f6318a01-bbaa-4a22-88a9-e5193b03d8b3/i85336vr.png

HTTP Response

200
216.239.34.36:443

region1.google-analytics.com

tls, http2

chrome.exe

1.1kB
6.5kB
12
9
216.239.34.36:443

https://region1.google-analytics.com/g/collect?v=2&tid=G-6S5388LRGM&gtm=45je42e0v9137156704za200&_p=1708357166576&gcd=13l3l3l3l1&npa=0&dma=0&cid=547248687.1708357168&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1708357168&sct=1&seg=0&dl=https%3A%2F%2Ftwitch.tubson.pl%2F&dt=Twitch&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4913

tls, http2

chrome.exe

7.3kB
8.5kB
27
22

HTTP Request

POST https://region1.google-analytics.com/g/collect?v=2&tid=G-6S5388LRGM&gtm=45je42e0v9137156704za200&_p=1708357166576&gcd=13l3l3l3l1&npa=0&dma=0&cid=547248687.1708357168&ul=en-us&sr=1280x720&uaa=x86&uab=64&uafvl=Chromium%3B106.0.5249.119%7CGoogle%2520Chrome%3B106.0.5249.119%7CNot%253BA%253DBrand%3B99.0.0.0&uamb=0&uam=&uap=Windows&uapv=10.0.0&uaw=0&pscdl=noapi&_s=1&sid=1708357168&sct=1&seg=0&dl=https%3A%2F%2Ftwitch.tubson.pl%2F&dt=Twitch&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=4913
35.190.80.1:443

https://a.nel.cloudflare.com/report/v3?s=%2BRYrDzBIhAoTIjTMDxI5I5hZ7cS%2Fq6w5%2F42yjnvzJghVtwEG9excCvn0lqYk08OFm89La%2FH5NGiyfk0Fkyg4NjjL93h7IH2%2BHAokr%2F5UJepLpjOumXJZBSOxLpX9jH5bzw%3D%3D

tls, http2

chrome.exe

4.7kB
6.7kB
31
22

HTTP Request

OPTIONS https://a.nel.cloudflare.com/report/v3?s=q1OnZgQoha5y2HPNWiZRdabg%2FRjDg8s%2B%2Bju9uxypWLaM%2FSovX1T9VzUKIqlSAcd9f%2BBiQNd7Hg4hiy0ZoBXyTMbSBCeeXK1RF92OEoUOZj1Hi2k3wHGTRi1UhFsI%2FDHa6Y%2B5

HTTP Request

OPTIONS https://a.nel.cloudflare.com/report/v3?s=KbT0rw9TetvePc6NFc5Deedoe0puF%2Blo5QNOqtoABmfi%2FHSo%2BU2%2FfJO37iAKDTHYyOt2yMZdk5kRBZIHioU2iSdnZ2hcyJWtzg14ox6QMGRDzHvbMwCmZ2uI3fWJ

HTTP Request

OPTIONS https://a.nel.cloudflare.com/report/v3?s=%2BRYrDzBIhAoTIjTMDxI5I5hZ7cS%2Fq6w5%2F42yjnvzJghVtwEG9excCvn0lqYk08OFm89La%2FH5NGiyfk0Fkyg4NjjL93h7IH2%2BHAokr%2F5UJepLpjOumXJZBSOxLpX9jH5bzw%3D%3D
142.250.178.4:443

https://www.google.com/async/newtab_promos

tls, http2

chrome.exe

3.1kB
10.9kB
30
34

HTTP Request

GET https://www.google.com/async/ddljson?async=ntp:2

HTTP Request

GET https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0

HTTP Request

GET https://www.google.com/async/newtab_promos
104.84.81.174:443

https://signin.ebay.com/ws/eBayISAPI.dll?SignIn

tls, http2

chrome.exe

2.1kB
45.5kB
22
50

HTTP Request

GET https://signin.ebay.com/ws/eBayISAPI.dll?SignIn

HTTP Response

200
104.84.81.174:443

signin.ebay.com

tls

chrome.exe

989 B
6.3kB
9
10
162.125.65.18:443

www.dropbox.com

tls

chrome.exe

2.1kB
46.1kB
19
47
52.222.148.112:443

https://www.amazon.com/gp/flex/sign-out.html?action=sign-out

tls, http2

chrome.exe

1.9kB
7.5kB
17
18

HTTP Request

GET https://www.amazon.com/gp/flex/sign-out.html?action=sign-out

HTTP Response

302
172.217.16.229:443

https://mail.google.com/mail

tls, http2

chrome.exe

3.1kB
11.1kB
33
42

HTTP Request

GET https://mail.google.com/mail/?logout

HTTP Request

GET https://mail.google.com/mail/?logout&view

HTTP Request

GET https://mail.google.com/mail/logout?hl=en-US

HTTP Request

GET https://mail.google.com/mail
52.178.182.128:443

https://secure.skype.com/account/logout

tls, http

chrome.exe

2.1kB
8.9kB
13
16

HTTP Request

GET https://secure.skype.com/account/logout

HTTP Response

302
23.48.165.145:443

secure.hulu.com

tls

chrome.exe

1.0kB
7.0kB
9
14
140.82.121.3:443

github.com

tls

chrome.exe

1.0kB
3.3kB
10
8
52.214.181.141:443

https://www.netflix.com/Logout

tls, http2

chrome.exe

2.1kB
26.4kB
21
33

HTTP Request

GET https://www.netflix.com/Logout
140.82.121.3:443

https://github.com/

tls, http2

chrome.exe

2.1kB
55.8kB
20
54

HTTP Request

GET https://github.com/logout

HTTP Response

302

HTTP Request

GET https://github.com/

HTTP Response

200
23.48.165.145:443

https://secure.hulu.com/

tls, http

chrome.exe

2.6kB
9.8kB
18
21

HTTP Request

GET https://secure.hulu.com/logout

HTTP Response

302

HTTP Request

GET https://secure.hulu.com/

HTTP Response

301
52.214.181.141:443

www.netflix.com

tls, http2

chrome.exe

943 B
3.7kB
8
7
172.217.169.78:443

https://www.youtube.com/

tls, http2

chrome.exe

2.1kB
11.9kB
18
23

HTTP Request

POST https://www.youtube.com/
52.222.201.85:443

https://www.deviantart.com/

tls, http2

chrome.exe

2.8kB
165.1kB
32
134

HTTP Request

POST https://www.deviantart.com/users/logout

HTTP Response

302

HTTP Request

GET https://www.deviantart.com/

HTTP Response

200
162.159.137.232:443

https://discord.com/api/v9/auth/logout

tls, http2

chrome.exe

2.0kB
4.8kB
16
15

HTTP Request

POST https://discord.com/api/v9/auth/logout

HTTP Response

401
18.155.129.6:443

https://soundcloud.com/logout

tls, http2

chrome.exe

1.9kB
25.5kB
18
32

HTTP Request

GET https://soundcloud.com/logout

HTTP Response

401
23.214.154.77:443

https://steamcommunity.com/?action=doLogout

tls, http

chrome.exe

1.7kB
16.0kB
11
19

HTTP Request

GET https://steamcommunity.com/?action=doLogout

HTTP Response

200
104.78.177.128:443

https://store.steampowered.com/

tls, http

chrome.exe

2.8kB
92.7kB
21
74

HTTP Request

GET https://store.steampowered.com/logout/

HTTP Response

302

HTTP Request

GET https://store.steampowered.com/

HTTP Response

200
142.250.27.84:443

https://accounts.google.com/ServiceLogin?elo=1

tls, http2

chrome.exe

2.2kB
9.7kB
20
24

HTTP Request

GET https://accounts.google.com/Logout

HTTP Request

GET https://accounts.google.com/ServiceLogin?elo=1
51.105.176.200:443

https://login.skype.com/logout?client_id=360605&redirect_uri=https%3A%2F%2Fsecure.skype.com%2Fportal%2Flogin&response_type=postgrant&state=9f2d96db08dcaa75e3f6c80f

tls, http

chrome.exe

2.3kB
6.0kB
14
14

HTTP Request

GET https://login.skype.com/logout?client_id=360605&redirect_uri=https%3A%2F%2Fsecure.skype.com%2Fportal%2Flogin&response_type=postgrant&state=9f2d96db08dcaa75e3f6c80f

HTTP Response

302
185.15.59.224:443

https://en.wikipedia.org/w/index.php?title=Special:UserLogout

tls, http2

chrome.exe

1.9kB
13.5kB
16
22

HTTP Request

GET https://en.wikipedia.org/w/index.php?title=Special:UserLogout

HTTP Response

200
192.0.78.9:443

https://wordpress.com/wp-login.php?action=logout

tls, http2

chrome.exe

1.9kB
7.9kB
17
17

HTTP Request

GET https://wordpress.com/wp-login.php?action=logout

HTTP Response

403
104.21.13.212:443

jshop.partners

tls, http2

chrome.exe

943 B
5.1kB
8
7
104.21.13.212:443

https://jshop.partners/panel/logout

tls, http2

chrome.exe

2.0kB
15.7kB
18
27

HTTP Request

GET https://jshop.partners/panel/logout

HTTP Response

403
212.82.100.140:443

https://login.yahoo.com/account/logout?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/

tls, http2

chrome.exe

2.3kB
8.5kB
20
22

HTTP Request

GET https://login.yahoo.com/config/login?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/

HTTP Request

GET https://login.yahoo.com/?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/

HTTP Request

GET https://login.yahoo.com/account/logout?.src=fpctx&logout=1&.direct=1&.done=https://www.yahoo.com/
23.48.165.145:443

https://www.hulu.com/welcome?orig_referrer=https%3A%2F%2Ftwitch.tubson.pl%2F

tls, http2

chrome.exe

2.4kB
50.2kB
26
57

HTTP Request

GET https://www.hulu.com/

HTTP Response

302

HTTP Request

GET https://www.hulu.com/welcome?orig_referrer=https%3A%2F%2Ftwitch.tubson.pl%2F

HTTP Response

200
23.48.165.145:443

www.hulu.com

tls

chrome.exe

1.0kB
6.8kB
9
11
104.16.57.101:443

static.cloudflareinsights.com

tls, http2

chrome.exe

1.1kB
3.0kB
10
8
87.248.114.12:443

https://uk.yahoo.com/?p=us

tls, http2

chrome.exe

2.9kB
202.7kB
35
162

HTTP Request

GET https://www.yahoo.com/

HTTP Request

GET https://uk.yahoo.com/?p=us
87.248.114.12:443

www.yahoo.com

tls, http2

chrome.exe

1.0kB
6.3kB
10
11
172.217.169.67:443

https://beacons.gcp.gvt2.com/domainreliability/upload

tls, http2

chrome.exe

3.9kB
7.3kB
18
20

HTTP Request

POST https://beacons.gcp.gvt2.com/domainreliability/upload
172.217.169.67:443

beacons.gcp.gvt2.com

tls, http2

chrome.exe

953 B
5.8kB
8
8
172.217.169.3:80

http://www.gstatic.com/generate_204

http

chrome.exe

724 B
455 B
9
7

HTTP Request

GET http://www.gstatic.com/generate_204

HTTP Response

204
172.217.169.81:443

https://csp.withgoogle.com/csp/report-to/gws/cdt1

tls, http2

chrome.exe

1.8kB
7.5kB
16
18

HTTP Request

OPTIONS https://csp.withgoogle.com/csp/report-to/gws/cdt1
104.16.57.101:443

static.cloudflareinsights.com

tls, http2

chrome.exe

1.0kB
1.0kB
9
7
216.239.32.116:443

https://beacons4.gvt2.com/domainreliability/upload-nel

tls, http2

chrome.exe

1.8kB
6.8kB
16
15

HTTP Request

OPTIONS https://beacons4.gvt2.com/domainreliability/upload-nel
216.239.32.116:443

beacons4.gvt2.com

tls, http2

chrome.exe

953 B
6.2kB
8
8

8.8.8.8:53

twitch.tubson.pl

dns

chrome.exe

62 B
94 B
1
1

DNS Request

twitch.tubson.pl

DNS Response

104.21.31.222

172.67.180.6
8.8.8.8:53

apps.identrust.com

dns

chrome.exe

64 B
165 B
1
1

DNS Request

apps.identrust.com

DNS Response

96.17.179.184

96.17.179.205
8.8.8.8:53

222.31.21.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

222.31.21.104.in-addr.arpa
8.8.8.8:53

14.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.160.190.20.in-addr.arpa
104.21.31.222:443

twitch.tubson.pl

https

chrome.exe

538.8kB
54.6MB
5599
45277
8.8.8.8:53

static.cloudflareinsights.com

dns

chrome.exe

75 B
107 B
1
1

DNS Request

static.cloudflareinsights.com

DNS Response

104.16.57.101

104.16.56.101
8.8.8.8:53

r2.e-z.host

dns

chrome.exe

57 B
89 B
1
1

DNS Request

r2.e-z.host

DNS Response

104.21.45.167

172.67.216.169
8.8.8.8:53

184.179.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

184.179.17.96.in-addr.arpa
8.8.8.8:53

181.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

181.178.17.96.in-addr.arpa
8.8.8.8:53

101.57.16.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

101.57.16.104.in-addr.arpa
8.8.8.8:53

167.45.21.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

167.45.21.104.in-addr.arpa
8.8.8.8:53

228.249.119.40.in-addr.arpa

dns

219 B
159 B
3
1

DNS Request

228.249.119.40.in-addr.arpa

DNS Request

228.249.119.40.in-addr.arpa

DNS Request

228.249.119.40.in-addr.arpa
8.8.8.8:53

232.179.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

232.179.250.142.in-addr.arpa
8.8.8.8:53

region1.google-analytics.com

dns

chrome.exe

74 B
106 B
1
1

DNS Request

region1.google-analytics.com

DNS Response

216.239.34.36

216.239.32.36
8.8.8.8:53

234.187.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

234.187.250.142.in-addr.arpa
8.8.8.8:53

36.34.239.216.in-addr.arpa

dns

72 B
132 B
1
1

DNS Request

36.34.239.216.in-addr.arpa
8.8.8.8:53

a.nel.cloudflare.com

dns

chrome.exe

66 B
82 B
1
1

DNS Request

a.nel.cloudflare.com

DNS Response

35.190.80.1
8.8.8.8:53

1.80.190.35.in-addr.arpa

dns

70 B
120 B
1
1

DNS Request

1.80.190.35.in-addr.arpa
35.190.80.1:443

a.nel.cloudflare.com

https

chrome.exe

3.8kB
5.2kB
8
9
216.239.34.36:443

region1.google-analytics.com

https

chrome.exe

3.8kB
6.9kB
8
10
224.0.0.251:5353

chrome.exe

204 B
3
8.8.8.8:53

140.32.126.40.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

140.32.126.40.in-addr.arpa
8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

www.google.com

dns

chrome.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.178.4
142.250.178.4:443

www.google.com

https

chrome.exe

5.2kB
17.9kB
25
28
8.8.8.8:53

4.178.250.142.in-addr.arpa

dns

144 B
110 B
2
1

DNS Request

4.178.250.142.in-addr.arpa

DNS Request

4.178.250.142.in-addr.arpa
8.8.8.8:53

97.17.167.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

97.17.167.52.in-addr.arpa
8.8.8.8:53

50.23.12.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

50.23.12.20.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

217.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

217.135.221.88.in-addr.arpa
8.8.8.8:53

81.171.91.138.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

81.171.91.138.in-addr.arpa
8.8.8.8:53

www.amazon.com

dns

chrome.exe

180 B
465 B
3
3

DNS Request

www.amazon.com

DNS Response

52.222.148.112

DNS Request

www.amazon.com

DNS Response

52.222.148.112

DNS Request

www.amazon.com

DNS Response

52.222.148.112
8.8.8.8:53

www.dropbox.com

dns

chrome.exe

122 B
222 B
2
2

DNS Request

www.dropbox.com

DNS Response

162.125.65.18

DNS Request

www.dropbox.com

DNS Response

162.125.65.18
8.8.8.8:53

signin.ebay.com

dns

chrome.exe

61 B
153 B
1
1

DNS Request

signin.ebay.com

DNS Response

104.84.81.174
8.8.8.8:53

github.com

dns

chrome.exe

112 B
144 B
2
2

DNS Request

github.com

DNS Response

140.82.121.3

DNS Request

github.com

DNS Response

140.82.121.4
8.8.8.8:53

mail.google.com

dns

chrome.exe

61 B
77 B
1
1

DNS Request

mail.google.com

DNS Response

172.217.16.229
142.250.178.4:443

www.google.com

https

chrome.exe

4.0kB
11.8kB
25
27
8.8.8.8:53

secure.hulu.com

dns

chrome.exe

61 B
162 B
1
1

DNS Request

secure.hulu.com

DNS Response

23.48.165.145
8.8.8.8:53

www.netflix.com

dns

chrome.exe

122 B
508 B
2
2

DNS Request

www.netflix.com

DNS Response

52.214.181.141

54.170.196.176

54.246.79.9

DNS Request

www.netflix.com

DNS Response

54.155.178.5

54.74.73.31

3.251.50.149
8.8.8.8:53

secure.skype.com

dns

chrome.exe

62 B
120 B
1
1

DNS Request

secure.skype.com

DNS Response

52.178.182.128
8.8.8.8:53

soundcloud.com

dns

chrome.exe

60 B
124 B
1
1

DNS Request

soundcloud.com

DNS Response

18.155.129.6

18.155.129.112

18.155.129.19

18.155.129.12
8.8.8.8:53

steamcommunity.com

dns

chrome.exe

64 B
80 B
1
1

DNS Request

steamcommunity.com

DNS Response

23.214.154.77
8.8.8.8:53

discord.com

dns

chrome.exe

57 B
137 B
1
1

DNS Request

discord.com

DNS Response

162.159.137.232

162.159.138.232

162.159.128.233

162.159.135.232

162.159.136.232
8.8.8.8:53

www.deviantart.com

dns

chrome.exe

64 B
128 B
1
1

DNS Request

www.deviantart.com

DNS Response

52.222.201.85

52.222.201.23

52.222.201.47

52.222.201.76
8.8.8.8:53

www.youtube.com

dns

chrome.exe

61 B
271 B
1
1

DNS Request

www.youtube.com

DNS Response

172.217.169.78

142.250.179.238

142.250.180.14

142.250.187.206

142.250.187.238

172.217.16.238

142.250.178.14

142.250.200.46

142.250.200.14

216.58.201.110

216.58.204.78
8.8.8.8:53

store.steampowered.com

dns

chrome.exe

136 B
168 B
2
2

DNS Request

store.steampowered.com

DNS Response

104.78.177.128

DNS Request

store.steampowered.com

DNS Response

104.78.177.128
8.8.8.8:53

accounts.google.com

dns

chrome.exe

130 B
162 B
2
2

DNS Request

accounts.google.com

DNS Response

142.250.27.84

DNS Request

accounts.google.com

DNS Response

142.250.27.84
52.222.148.112:443

www.amazon.com

https

chrome.exe

8.6kB
96.1kB
61
94
8.8.8.8:53

229.16.217.172.in-addr.arpa

dns

73 B
140 B
1
1

DNS Request

229.16.217.172.in-addr.arpa
8.8.8.8:53

174.81.84.104.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

174.81.84.104.in-addr.arpa
8.8.8.8:53

18.65.125.162.in-addr.arpa

dns

72 B
122 B
1
1

DNS Request

18.65.125.162.in-addr.arpa
8.8.8.8:53

112.148.222.52.in-addr.arpa

dns

73 B
131 B
1
1

DNS Request

112.148.222.52.in-addr.arpa
8.8.8.8:53

128.182.178.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

128.182.178.52.in-addr.arpa
142.250.27.84:443

accounts.google.com

https

chrome.exe

4.9kB
18.0kB
32
40
8.8.8.8:53

145.165.48.23.in-addr.arpa

dns

144 B
274 B
2
2

DNS Request

145.165.48.23.in-addr.arpa

DNS Request

145.165.48.23.in-addr.arpa
8.8.8.8:53

3.121.82.140.in-addr.arpa

dns

71 B
115 B
1
1

DNS Request

3.121.82.140.in-addr.arpa
8.8.8.8:53

141.181.214.52.in-addr.arpa

dns

146 B
274 B
2
2

DNS Request

141.181.214.52.in-addr.arpa

DNS Request

141.181.214.52.in-addr.arpa
8.8.8.8:53

78.169.217.172.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

78.169.217.172.in-addr.arpa
8.8.8.8:53

85.201.222.52.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

85.201.222.52.in-addr.arpa
8.8.8.8:53

6.129.155.18.in-addr.arpa

dns

71 B
127 B
1
1

DNS Request

6.129.155.18.in-addr.arpa
8.8.8.8:53

77.154.214.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

77.154.214.23.in-addr.arpa
8.8.8.8:53

login.skype.com

dns

chrome.exe

122 B
236 B
2
2

DNS Request

login.skype.com

DNS Request

login.skype.com

DNS Response

51.105.176.200

DNS Response

51.105.176.200
8.8.8.8:53

232.137.159.162.in-addr.arpa

dns

74 B
136 B
1
1

DNS Request

232.137.159.162.in-addr.arpa
216.239.34.36:443

region1.google-analytics.com

https

chrome.exe

5.9kB
7.4kB
19
21
8.8.8.8:53

84.27.250.142.in-addr.arpa

dns

144 B
210 B
2
2

DNS Request

84.27.250.142.in-addr.arpa

DNS Request

84.27.250.142.in-addr.arpa
8.8.8.8:53

128.177.78.104.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

128.177.78.104.in-addr.arpa
8.8.8.8:53

200.176.105.51.in-addr.arpa

dns

146 B
318 B
2
2

DNS Request

200.176.105.51.in-addr.arpa

DNS Request

200.176.105.51.in-addr.arpa
8.8.8.8:53

en.wikipedia.org

dns

chrome.exe

124 B
214 B
2
2

DNS Request

en.wikipedia.org

DNS Response

185.15.59.224

DNS Request

en.wikipedia.org

DNS Response

185.15.59.224
8.8.8.8:53

51.201.222.52.in-addr.arpa

dns

72 B
129 B
1
1

DNS Request

51.201.222.52.in-addr.arpa
8.8.8.8:53

23.149.64.172.in-addr.arpa

dns

144 B
268 B
2
2

DNS Request

23.149.64.172.in-addr.arpa

DNS Request

23.149.64.172.in-addr.arpa
8.8.8.8:53

wordpress.com

dns

chrome.exe

59 B
91 B
1
1

DNS Request

wordpress.com

DNS Response

192.0.78.9

192.0.78.17
8.8.8.8:53

224.59.15.185.in-addr.arpa

dns

72 B
113 B
1
1

DNS Request

224.59.15.185.in-addr.arpa
8.8.8.8:53

67.204.58.216.in-addr.arpa

dns

144 B
338 B
2
2

DNS Request

67.204.58.216.in-addr.arpa

DNS Request

67.204.58.216.in-addr.arpa
8.8.8.8:53

226.21.18.104.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

226.21.18.104.in-addr.arpa
8.8.8.8:53

login.yahoo.com

dns

chrome.exe

122 B
242 B
2
2

DNS Request

login.yahoo.com

DNS Response

212.82.100.140

DNS Request

login.yahoo.com

DNS Response

212.82.100.140
8.8.8.8:53

jshop.partners

dns

chrome.exe

60 B
92 B
1
1

DNS Request

jshop.partners

DNS Response

104.21.13.212

172.67.133.31
8.8.8.8:53

9.78.0.192.in-addr.arpa

dns

138 B
268 B
2
2

DNS Request

9.78.0.192.in-addr.arpa

DNS Request

9.78.0.192.in-addr.arpa
8.8.8.8:53

73.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

73.159.190.20.in-addr.arpa
8.8.8.8:53

212.13.21.104.in-addr.arpa

dns

144 B
268 B
2
2

DNS Request

212.13.21.104.in-addr.arpa

DNS Request

212.13.21.104.in-addr.arpa
8.8.8.8:53

140.100.82.212.in-addr.arpa

dns

146 B
232 B
2
2

DNS Request

140.100.82.212.in-addr.arpa

DNS Request

140.100.82.212.in-addr.arpa
8.8.8.8:53

www.hulu.com

dns

chrome.exe

116 B
334 B
2
2

DNS Request

www.hulu.com

DNS Response

23.48.165.145

23.48.165.135

DNS Request

www.hulu.com

DNS Response

23.48.165.145

23.48.165.135
35.190.80.1:443

a.nel.cloudflare.com

https

chrome.exe

5.3kB
7.7kB
14
17
8.8.8.8:53

182.178.17.96.in-addr.arpa

dns

144 B
274 B
2
2

DNS Request

182.178.17.96.in-addr.arpa

DNS Request

182.178.17.96.in-addr.arpa
8.8.8.8:53

www.yahoo.com

dns

chrome.exe

177 B
408 B
3
3

DNS Request

www.yahoo.com

DNS Response

87.248.114.12

87.248.114.11

DNS Request

www.yahoo.com

DNS Response

87.248.114.12

87.248.114.11

DNS Request

www.yahoo.com

DNS Response

87.248.114.12

87.248.114.11
8.8.8.8:53

12.114.248.87.in-addr.arpa

dns

72 B
111 B
1
1

DNS Request

12.114.248.87.in-addr.arpa
8.8.8.8:53

beacons.gcp.gvt2.com

dns

chrome.exe

66 B
112 B
1
1

DNS Request

beacons.gcp.gvt2.com

DNS Response

172.217.169.67
8.8.8.8:53

67.169.217.172.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

67.169.217.172.in-addr.arpa
8.8.8.8:53

11.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

11.227.111.52.in-addr.arpa
8.8.8.8:53

180.178.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

180.178.17.96.in-addr.arpa
8.8.8.8:53

3.169.217.172.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

3.169.217.172.in-addr.arpa
172.217.169.67:443

beacons.gcp.gvt2.com

https

chrome.exe

4.0kB
7.6kB
11
15
8.8.8.8:53

79.121.231.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

79.121.231.20.in-addr.arpa
8.8.8.8:53

csp.withgoogle.com

dns

chrome.exe

64 B
80 B
1
1

DNS Request

csp.withgoogle.com

DNS Response

172.217.169.81
172.217.169.81:443

csp.withgoogle.com

https

chrome.exe

3.7kB
7.8kB
9
11
8.8.8.8:53

81.169.217.172.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

81.169.217.172.in-addr.arpa
8.8.8.8:53

122.10.44.20.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

122.10.44.20.in-addr.arpa
8.8.8.8:53

www.google.com

dns

chrome.exe

120 B
152 B
2
2

DNS Request

www.google.com

DNS Response

142.250.178.4

DNS Request

www.google.com

DNS Response

142.250.178.4
8.8.8.8:53

uk.yahoo.com

dns

chrome.exe

58 B
128 B
1
1

DNS Request

uk.yahoo.com

DNS Response

87.248.114.12

87.248.114.11
142.250.178.4:443

www.google.com

https

chrome.exe

4.3kB
7.8kB
17
16
172.217.169.67:443

beacons.gcp.gvt2.com

https

chrome.exe

6.4kB
6.3kB
13
13
216.239.34.36:443

region1.google-analytics.com

https

chrome.exe

4.4kB
3.1kB
12
12
8.8.8.8:53

beacons4.gvt2.com

dns

chrome.exe

63 B
79 B
1
1

DNS Request

beacons4.gvt2.com

DNS Response

216.239.32.116
35.190.80.1:443

a.nel.cloudflare.com

https

chrome.exe

4.3kB
3.8kB
13
12
216.239.32.116:443

beacons4.gvt2.com

https

chrome.exe

3.7kB
7.8kB
8
11
8.8.8.8:53

116.32.239.216.in-addr.arpa

dns

146 B
202 B
2
2

DNS Request

116.32.239.216.in-addr.arpa

DNS Request

116.32.239.216.in-addr.arpa
172.217.169.67:443

beacons.gcp.gvt2.com

https

chrome.exe

7.2kB
6.4kB
17
16
216.239.34.36:443

region1.google-analytics.com

https

chrome.exe

3.8kB
3.0kB
9
9
35.190.80.1:443

a.nel.cloudflare.com

https

chrome.exe

4.0kB
2.4kB
11
8

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
062cc84c0218b55fdd1b19857d52cc59

SHA1
e25a3051e499e2269d9e2ea0f384eaa781d3ce24

SHA256
8fe2e20bb3cf656eff404cd69a740bdbeb2abde044ac1c802270c6bb349129f0

SHA512
bac28b92d9f095b08e6b68eadc1d11814faaf8f7ce24f8da404eac4127bbc560817492ce72a681192e80605d7feedfedf20543b0503840c33488d5728afd583b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007

Filesize
64KB

MD5
6d2b6983db15678d6ad322d516c14c04

SHA1
eff560800f7bd4fde2c9d145c5f48712ec3b3061

SHA256
3b8548478684704ed0aa1d93ea9912c27c94ff943d5d506c256e51eb1c3a10d9

SHA512
ae2b498baf2bc16523107384d5ccf1d244ca381c2fb4537bc74c88604fcd8548bd292ee2e11c3c57eae6be3f4fe0b95fbb931405a1273ea909e6b0ec8defa844

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

Filesize
192KB

MD5
b4dfd67d9291c146c575c1351417f3c2

SHA1
69ac5d93b38b84f3beb704d15907064b47a55f78

SHA256
a183bb55622291fc153ed887bf68b9e15b5a2f50f6efa791ef95cb8a5284a6a5

SHA512
e34971625c010e9e45c45e6368d224dd4d90365657ae6fb4cb2665744e162fb521680adc069037abaa63122cea8cf445226ca210905ab9da6765ae8123c40e9b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\0d2738c0c1176629_0

Filesize
260B

MD5
2b8b0a382494b1ad220813ca559369e3

SHA1
5fba08c85700e371005e287099c264230cd4dfc8

SHA256
3ba45784b0953eeb1aa2d42856f02cd91d696c55999e6cbc1dbc015756ab2f4d

SHA512
2b7ccaa52c5e17c82247d4b664038d096a7daf9f92c1b1af2ac6f113c5b933a82478d77b721a3e9921db43e4c4b75d81b7844739e16ae45a96bf66d223e03c33

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\198d859e6c987785_0

Filesize
192KB

MD5
91dc17385d6078d01c0ea4b16e500919

SHA1
46d50a0f3058c026f3d0d9a0771e0e8633b30e1a

SHA256
9bcc22fa6d239384865aebfeee5b0b574d22cccd0f4fc5fec8e1ecb03a9e0e3c

SHA512
4a8a443158e372b2c4643d73fb794943ec4bbe5f1da306e65a4c26c682a6b3a19461fc9c9ee6534c2d15225b8e091e9ea45001c4cf8925f429d34b1a31e771b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
d177a1c47d954110b86087f96fe567d3

SHA1
ac74c7e0e2d914a6f68c4f18f5339579f4139301

SHA256
39c90b48c468343c8414266dda5a1d44a130202ac0b2fef3f3ad0ce1de8bc6e2

SHA512
c2c065720fe3eda83f7cdd7f9fb7f0302983dec8222c4ef612f0c81b8192dcf4589d5d113a254858dfb70f7b1c9e577aa0303e14a7480cb259c4a23efe267933

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
92f59d313e9e70e27854b440f876bae9

SHA1
d305076b29d5f34a2d73598c8920a3c86c09c78d

SHA256
14291e899fd6dfcd78360373ac5a597e567950f1e7aa187f060519878a6058d2

SHA512
8393db0b628103dd624ccce8495a899aadf1674c2641c1ed0c9f4ddbbd07c30daccb0d5160d687ae38fb91144137855c50a31f6579c86978349dc2120a10c0a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
23e12d6e3b45312242755b8939a969ae

SHA1
3de5ba63f57925d1323a25479a57454facd6a6da

SHA256
40b5553361910868e53a67b543375faa91b91bdaefb0cba6df75b3744df61f0b

SHA512
af9e65a3f6b4afbf2fd27a07071e5795832ab9425555d3559d547d3a4e97bad13433d47c4f94b761c835874ed3070c358d57a6849e5f9d76546e8f6bad5b7c49

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
ed5f7a68b58ce8a6304d3d7d48ea7ea2

SHA1
068957c970f393a8f3b26fdc06c14d953ed96bcf

SHA256
c11346c704c98e93a7e293a310a5a90cc871765a6ccaa15cdce92a7c5eff5bb3

SHA512
82a3181e6c1830bebf9b4bfd9ce44a3c0f7dccb8623062aae891e11137c1235567fe997e48dfce9abf743d322d6b466af1bbfcb1f4a605b6d8bb4905d3692242

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
adaf5847f9e9905aeea973e82439f58e

SHA1
4a0796ba918500dd6fabc688081b8c98be50ba87

SHA256
f3ecc8f33ce76b67ef0fb2fb66c1f45619e908c197abea1bba41a03aa1ad6f81

SHA512
bfac61d2f0faae08d7605f0b3f934e4b10b7d565d59bcc33423e3e989df06b1415dac0d6844a8a65c7e836de9ec4c1503e0f97e9fdd2066d8fa64795ca3f3370

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
77975f9699bbdb84407fbf8690d23111

SHA1
ae9a7afd24de65ca14b20ba8a22b321c72f3df92

SHA256
7b05c8905657da93a12258a4a525325663efdfcf3ba4c413da218564e97e7217

SHA512
4ad882f03bb2cb5009cb67e4e5bf7c359f3f881f1ce33d30b4c7defd8a991e53a9aedaa69b9656bb3595285d8814b4fa03f9200615aff1b5accf8bef36b20294

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
cd7cb6da5d0be578260ff02e695b7d55

SHA1
8cb7b20e15265da5eed221506db1f3f847bf95f4

SHA256
bb04f179078417e70b0481a68e72a81286e7852dda7a51ee81771d9c14f7c416

SHA512
8e7f7c62a843268b9032bf107259840e5528b780b9cf752db8122da7675757e1d81e6d47b178c8f24947822a6a94be1b3cc7fd47e25f08e108d4de44ec680aed

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
9078b223c66bc14d1f5355ebe32929f1

SHA1
833a4eb465315a8d63462c78d2e862eb1c1b6669

SHA256
56ede227e0ad163944d714e658c31c031db9c316d058fa7bc4b98239045a44a0

SHA512
3a350e9f697a4281c57e054f91e8eaf5f70f406929aea550e94811de1e992cc6ebf3a6a3d6f5b7213da963ee67b45be57e3e2414202fe1350cce2a58687321d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
8f345168ee558eb70fedd64f913650eb

SHA1
54b28e0ae083bb9248da404a31644fda6ea1e549

SHA256
ee0301abe013e107db7c3e271b5f180dd68dc9b047e9778402bb4faf92842d62

SHA512
22d8c264b021911312258d6db4266daa3f653c7b854a21c2354989d42bb265affbda6db9133aa51a95f7d489764e04d6b71a3db79d0cda4eb77a887fdb1ebe58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
2KB

MD5
073a97ea4d64a442a5180305efc95344

SHA1
bf1b10b5bad77883b665958190da760ac5390267

SHA256
21fe21ff1b818177410de8ccf129ccfbe534480a52b52741f756d57898815ade

SHA512
bef2c2fe07371ad84ef658f7f1550dd16ccc9a23245a5075f6cd7df77055114470b8b8c65887be3062c592c03b9b37604ed11ceb3e04760e59ee2cdc5233b84f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
5451593d4aca91c15115dda3a925a69f

SHA1
06eba1140811c8661e510f03c18b072956637c71

SHA256
4ecb873284c7e7ed2476ff903c29a60d5fb76d2b2d69b198ec7f5ad472287d82

SHA512
b6357981beb8efb25c3424aef533742f8bd341cc9c5869b597840c33b0e53b07202cd121b00afc267973c3d4d9aa86fc723fe38270f3cd9f05467c226d5eb100

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
005848749bd19a5aea6cd6137db9ed25

SHA1
3a9d602119ad498d7d09c226ca876adc78f49392

SHA256
040d73a336c01918122beb97f1db7038f88ec688371b76e07d861b26ef9151d1

SHA512
463261dd53c288d6aeb5fc77758284d98e763407ccc2c5fd0235fab538988b1c001e71d6fe4f684104d03a1c146e5f5838e9b6f1363a36e4ecfe3d3f380f0bac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
845445b64f6bb8890946a45676e4e03a

SHA1
290dcce240f48cc847f4dd8df7d0b883b124c1bf

SHA256
454b1c00fceaef0ad4286b319f4e51bd3152cccb321d68ac58bedfc4cde68416

SHA512
55bd3270368744370963d2a96811e65f5c56352f49828044bfb73f39bea58d12bb6c4b57a7eacd31bb452075f7d3a8efa78f8323d34383e9d347765fcc0c607b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
538B

MD5
973326c4527cf7734a048bb496049920

SHA1
a5ac7ea1b57d6fb985c2f48939c8752d66c3fbf3

SHA256
18f264dc26dadb92072ca90f4f068af7170a45f199726d2d99765ca06d8d3d2b

SHA512
c264bf77badda6e7f9771c86692bebd09bde5eb3658abad015c065b2522f5ad9ecb4fc49d3a51cdcc7fac0ecfaf026656a5eb64f711ed2f567c950473613ce2e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
3KB

MD5
ba89bb8539383d52ae3a2e9bac8e115d

SHA1
d945e19a416d7ee512f038a436b3d4b282ced78f

SHA256
0bc0c51cc627864b33a3b99524ff0e7fc2742cb07e73bbb36c1f1c34e5f14136

SHA512
74fc4810ed94df97d28ef58c9aeba39a1d45196b61ac850a1bb68d09da29d33ea5a7e5d01c9c4ec89bfd7692d3bfa8742866a887a4cd5270ff6e6045ccbed7a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
970d7ddaf94ee1ef6153db2a05430d0a

SHA1
852ea53f8812daa33d702d72c2a54764ce1c85eb

SHA256
dbfc251f266267dd1e60a97901bb472996c98c4fefb4c274afdc5d5c6ddc5422

SHA512
1acaf322c5ef716006aefa3f885d4a35264f7ba9a18f5d96fe33a519f4fc59c3bcb1cda9a84e08751608a74b41a771b02c23f8f007b66a1d33f85f78696491cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
7e6d2a29d704e9e0c61d0b73dfdfac7f

SHA1
6eb6f1bc6efd286187f0153e24b7b64b3ec75f82

SHA256
b9ac72d220fb0ad0f1187f575ebedbd984ce3e9cf8ba570a6f6938f26c2f9b70

SHA512
27c7610bd45b0dc51808862a12bc04c09e3c6a40a0f9c17769be7750a21dfbd3df1db0d90707e3f0126a12259dfd8ac50ff5357ca2e279405172a85e96926017

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
8da1ea682b93c73b2670cfcf34406b37

SHA1
3895ce1279216f64eb136d8282dd6fc9b2198755

SHA256
260dab9c39529b1e71af276def25f9504ee937209a32855fced5bdf0bb4678ad

SHA512
2aaac98ca2940c600a72c71119f1acc022bb2cc6d48883a03d10ae589d3f99c46023a3dd28f89e75fda1d15ae3928d843b9c64cf7fce8d43f08b2f9601375f0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
597c29d4307e14fd6db766ce09250cf9

SHA1
7458d89879f06bfe9f053df1b8efd2e59c9484d9

SHA256
aad13e2a4e5aace8141af7965d6a181144e503b1196121411a21f8d9525b04aa

SHA512
f0fbee2806fe7e03ff5691f350652512638268f6a34213839b43168ee52cae16b3358418923c71758de4c1a1bb8efcdb513edc1652edc7e5366aeaafad74053a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
5473a0ea0d7a926c3951474353f30770

SHA1
9fc0102417aada3e50e7405d864f0a9e92c5b0a6

SHA256
dc479a4c5634a3a55e4b8bc1004191a4ebbaf6e732e5f5e32068b1beaa94ef52

SHA512
27c2c70d019291da1aa83edf4f533bebad44ebdcfa419d05450083db7da81b1132e11a41f5fa31376a29fc277525a272377d4b2d33739b0c91169cc873666933

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
e14fae8dae93cef238f47a65fa60b0db

SHA1
73bb272d3389940d6c761979337c892e70804c53

SHA256
42e769a6dbe4b7002500160ef4333832068028d04fafab7ab7721555217a3587

SHA512
57f18c5c2d59c0a5161b8cfd0dc7fcc65c014f361538f2bb567941e5545736966d349f7bf91ffd2f7ae437bd266f62e8c45c390a598a307502f4528626403511

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
0f5f062da9dd0a1133f6661ffa66d5b1

SHA1
15c30ee81f7bd429dae675fb43fd691f222fe84d

SHA256
2b58ef0617790b436c7d6ea47a9bcb7971db009b1d51a6ae620ff17415da3586

SHA512
73a16c3da779c93795054cd6d7c9204b80713b19cee32ddea9cd51c8a327d63eb884b22864d0b56c343c0c05e9af1e3c7ffc41004a589ec0fb3ff232d952259b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
d6628d0c6fcc31fb8ea2e26b76599f6d

SHA1
547e5359be35f577459fa95bff99b9e49cb54247

SHA256
0c2a7ce4cdc4d30e47a9de9f14b989e435e673273adabd635f7cf9538433bc3e

SHA512
0d07df0fb12bd0619f1ae5e5879204e8345e4db7f62077b98447383f42d38172e45526c07a294e840fd16f0623b33a0e0d246cade7fa9c9ed4d75f3e03a16be1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
900d7dfad7b1380b43028bd3adaae773

SHA1
9a1d7422109bda41f6a634df4415b9411eed94d9

SHA256
e1ef414fc47c93e25e8d5310a8f349415f2921da064bf47b506a3568119407c5

SHA512
98e7dc267bca2414cb77947e5e4293634751550c4ddb52494822c93f98212635806aac08ccd66d862be49e6dbf794f2fabdf08528811ed31495710449a3760b9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
769ad31e89a20623c49affe93fd4c316

SHA1
4851299dba762d3509b522abc36e400ee3ae9e82

SHA256
9999dba8c8201ca5f367a2a2a33a49950f6b8d5165237a6fa73c0e419e838681

SHA512
72e54cf9da9641c73e4b55476c8bb61f4f949e280034e8ea63a1b893f2fcf029f782fb48309391b3d6907e36f578e938eb284ff16c8cec83efe1f40a6d766672

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
f27d4a7751554f1c3f6c40bb4ca870cd

SHA1
f2e311f2bfdce49f5d42f721c2c7df659c79d19f

SHA256
4c6f21d680dc31a0e2f15156c1e5991ee99ba356707e15a31f8f7e062c656f2c

SHA512
8e5416b7b06517b5f47dbe94ca8c6031ebcac9bede5c20b060b9bbfda78813d5cc0554fe15c8f76892e7de8f68221af1275cfa0ab0b7ede6af6e33a1104bc3e0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
1c37a3a4c9842c79519a50e100a60473

SHA1
8e566fe0d491cb77812de4778627f3f849e70573

SHA256
2be213461a992a4b9d134dcf631df56b9962aeb4df61f6f7c8032d39cb316158

SHA512
3e9d88d9d3750db44c2ce5c75a0b01662182a6ddb43447335d49868ed205b441ca84cd341b46c14faeedf1fd58f4ac94f47c721ff8d22932f2f14ac0d4e7a674

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
dba50e79d310269a99862944af3e18da

SHA1
1debdd708f8dc79cc9449c2dc9db1c91d92a3c7f

SHA256
8621b5ef375df358a20606d0f0657f8bde21af749461a7bbb4723c04571c792c

SHA512
b028b5875f14e6ffb83373f3b4b4668dbbe540c140dbaf0b4f1c8c22c2aca7cd3456fc5e55d0844ca00197fb7dddbeaeff088e466d103c16d95dd301235f7cc1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
ce3bc43ca6d3b3c22194e8b8dced430e

SHA1
b4a67f297e59640fc9fa4edb9b48b85b65c08302

SHA256
b633460da63fcaf9727e88dada233b0858cd4508a2ad606addbcbdb0a2099a72

SHA512
7e2d329f71f8eeaf868fc723b134b5253c4603ad4b7d173742937ed1778e0ff7f8426b5ac31933cda4c4dab5cfd3c699fdf1586ff83c73823cd0be85bedfa7ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
7860511d2f871ae84f97c47ad7211a84

SHA1
9c6cf959e06b3d6dbaa27431d58c0c7bd38d8504

SHA256
fd6300e649b6656e268650a427cee49973f81d8b51b04a2157aa17636a4126e1

SHA512
6cb7e60dfc661c979a8f407eaf007a08764d6adb1d796433f4592df8448aaa46c780cc151c08a70979c87d65236282ec6a8901eb244db04c2e4aa02025d73477

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
5a5a3d51f1695254243ecf9c2e98e4b2

SHA1
8d52895aa8ccd676c5839f9d5eaa594657551bc0

SHA256
0408e0f06336a8a0e9ee92d2b420df239048ce02f85c980a438990528c1a1981

SHA512
87aa0d723c7011586dfa1069017167de7c40d51bc95deda8901f0b7f001b23c7fc2c326b6d44b293e41d6b2fe74d0d833f3783ca700d517ce15b61e4fbf2ae74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
135KB

MD5
bff990f32e7d46a696b2b40474fc112a

SHA1
773fe9dd38c419f026771aedcdef01f249d77c69

SHA256
ee45a55f6f0565b7b036d9a5525ed134ab4d4651cddd33f1aa11f15d5988234e

SHA512
a9b7b7f97226de99d23e167ac362041b2a88a6b03d949756364428193f1c20f066cb1f05e807cc2fe485d99aadb7643b36ddd31206b5e7700baf1d0fc7ac2566

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
153KB

MD5
51dfec8188c3955cc8bdf6393778299a

SHA1
ede6f1afb8bd81787b4f1e69e554928b24bddda9

SHA256
68e7562c85f34cd28b3fcdf1db6b19cd66610b8746d148861d140e0a2a1a86ee

SHA512
f18fa10544431a367eded2debe2286e19a0883e499cfd61b844fefb88564a53247e4178e6cea5b5bc420b9133178eb16e1bb185c36bb4d312d50ff74707ccb51

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
5ddc505ff59d601fe1e3ee0e011bd818

SHA1
22138c9963fadb51d3c11bb57918c294b8c5e26a

SHA256
f6a5e38ccbdde223d122e9c6135422c1b5abcc0daa5f3845d1f59f5ca0c93b57

SHA512
d13170e638794c78adcc7713ad9caa1396b67bcd9c55f8cfbdc72ed855bbc341c635b50b19c8e46513369057b024b310704cd942ec6ab132acd191b0a152bfd0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
59d0dd6a01751952e31717b3dadef640

SHA1
71265ed204eca81ad6187d2375c55beecf66303e

SHA256
541f75f1892e4591057f8860be82b4ac70ec9c4c32dde89101f5fceef770d96f

SHA512
96567bf56f8d392de079b3ba692351c62b4c3627bc8ee019d37343cbe0f04fc7c0dc4d217044660ed3d86fd242ebb5418bf49cad822689b9078c1d3b881233f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
137KB

MD5
4ee1cfbb50ba4976fe49e0fd44924096

SHA1
285fd4d73a6f7e24475865a31776c5c6c2bc7f74

SHA256
06133d2f59047a4381539c4cad9e88d4fcae5b19ee1d7803eee0bb0e863b6728

SHA512
27be7d9b2c857d0aa18bd293d6c1a0e127fee5f52f1502d246d510c3abc8054a357587fad764398072d7f30a302724f2232978e809abfc136bbbcc49312ccb53

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
4ec6d2354b3b162920284fd2245ff01f

SHA1
5b4547e4ede73c529fc527dc188ca6f95b115481

SHA256
949a013ebb2b75733f7f87c5ce0eafb157bfd2d85168cc80cd6ed0c6479d99db

SHA512
f63f04193b1b6a4d430986cb98763ffa56bd95257a1ca04c85044029240aaa4822e3e45c89e4c338db15ad1fd045749af511a3e1467fd18e5523635b22fe5769

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
a5e22cf8ea27c5079c5ac3580bbfd165

SHA1
04afe72a15e46e9ce62914247304bd0c4c4e25df

SHA256
a1fa1b9170fd8e24b910ae165ea38dcd2ca8e726e14ffb1adf15014ec4f8c6aa

SHA512
fa1644fb0471a49f51a8c43acf82095ffa11490b3a36c02c92168c279a2b7c6c4fa65b6c715db276136d5b5c0220e06daaeedcc6eb4f602e1baddd94015b1e1b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
25f1dcd802fc89537e520591f9dcf3e4

SHA1
3b6166bc56626ffdcb3c2246077c12b744afddd9

SHA256
4c29ff683a097fd1f6a0df5f7dc4fda23fb07c623035ad0394ddd319e8c335cd

SHA512
da9c1e0e46c0cfcc71044ecea7884543e3fe2ed9e4c389b8633715b198a3df16ca860bfe392cb63e5adb72439a7e7876d70069c940ba4d2ff2e572d279cab9a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
115KB

MD5
ed0a268a6130ac71c547f5908c2eb040

SHA1
e580369da1c864527311855f327d3f147906a259

SHA256
000e31c51f9fe6b36ccd93dd9b430ab9e83b5300f7cbf503b7641cd68de90d05

SHA512
98fa2b5cf805d3c870d7903c68d18f206e95c58d3982067c30cd29d9249d8cd1085d3752ab41d99d2de5bfd6f8cb9cd96d34f3a114dc8987547070d136bae4f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
123KB

MD5
7e8a03dfd99fb07dc24e2158648e22c8

SHA1
d220f5a92f84eae1a2b6744071721c725bd0a121

SHA256
ede175a8ef11f6e3b19cf5deadf42e4afb74ec65b3657d9ce9945728ace2a846

SHA512
c4611a8c730476de63a12a1e3557417def7422e9539b6bd819d27f59c6011484d1d53ca1076b56513278e32a5eb4c599f38d28aecae04d1045b3362efa3f001f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
124KB

MD5
2dd856e713572e368596b77b41a93a80

SHA1
e94ca8a9571fa2224e7c2400be1705194175597f

SHA256
e29fb9ef5c4beb8d295f97fce59ecef429419b883660357f819f893886af2d99

SHA512
0f8cd9b4cc785832fca707448eeaa2d3b6f7dd55069afe736052a279c4d706ec1f97ef14c5b47bc9834c38aa2c42626c5c8d9e4f5bd9204b32933f1249296bcd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5910cf.TMP

Filesize
104KB

MD5
1d67e2aa363f3f610c0606e103b7f452

SHA1
e39791301fe8cc1d48606efce23a9b72e363148f

SHA256
bf4a0b4276dcbefd2361b406ac2be9f34e3f4e928d4e2336d002daf05058cf4f

SHA512
27a068906e780703685ae5452ee399633d20b9977236befda6cc55443529901e90818b775e8f50d17e386d51339c10fb4fcb7f4de5bffca72b677c10d852ff4e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\miska2 (1).jpg.crdownload

Filesize
128KB

MD5
d8f3cfd6a665ffbe3f0fba79b20f2085

SHA1
b2eaeaba1e2c0b5ada781da604f3dae1eea7bfdd

SHA256
1f5b09d0d815a183d15f0361722e2a50329cedda53c3b8faf450c9e431e10d05

SHA512
0da9072ccd85a084a45df55486e0b9b9815e2e4c96d4dff8b75dae9a9581ea51bfdd8b717b3e73989d081553ba16f821dfd8a9e1732b230a23a42fca7835ea92

Download Submit
C:\Users\Admin\Downloads\miska2.jpg

Filesize
143KB

MD5
3002d33b104a05063cb546d772150a7c

SHA1
426d180d2fe7d775792f40bccf3fedf2a8c10bde

SHA256
0d96d32736081ecad972c12e8bd9db8b217c143ba1afd5d6b474bf2ae8db9c93

SHA512
ce5c27186273c0271ed4f2f29012ec40cf1d6f5b6bb0a67027154197acb25bcbbad55f3afdf2338901f6a234e57e9ebb0f562fc057ff3af423b3b00f72f77e99

Download Submit
memory/3436-786-0x00000244FF560000-0x00000244FF570000-memory.dmp

Filesize
64KB

Download
memory/3436-790-0x00000244FF5B0000-0x00000244FF5C0000-memory.dmp

Filesize
64KB

Download
memory/3436-797-0x00000244881F0000-0x00000244881F1000-memory.dmp

Filesize
4KB

Download
memory/3436-799-0x0000024488270000-0x0000024488271000-memory.dmp

Filesize
4KB

Download
memory/3436-801-0x0000024488270000-0x0000024488271000-memory.dmp

Filesize
4KB

Download
memory/3436-802-0x0000024488300000-0x0000024488301000-memory.dmp

Filesize
4KB

Download
memory/3436-803-0x0000024488300000-0x0000024488301000-memory.dmp

Filesize
4KB

Download
memory/3436-804-0x0000024488310000-0x0000024488311000-memory.dmp

Filesize
4KB

Download
memory/3436-805-0x0000024488310000-0x0000024488311000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response