54f645f823ac5fb92d1448dc1a68270737fed214b31270797a62896a4bbc0ec7

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 19:05 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c9b8f5945f53a7b4aaedd75720d02cc_JaffaCakes118.html
Size

71KB
MD5

0c9b8f5945f53a7b4aaedd75720d02cc
SHA1

3aee039b07f22d9274a4bac334624ef0e9f65780
SHA256

54f645f823ac5fb92d1448dc1a68270737fed214b31270797a62896a4bbc0ec7
SHA512

acb11c33783c9bc83009280e8cb12c5b233b9af383ec965340ba65afb1dc3d9d2f363f0c0aa93b28201c7865982831b6d9fe9b03b0c79b59d02eb177a1d8995a
SSDEEP

1536:SvRK7ToXLjWOwZ+ZbtZx2S8TtwqGNpXMRuZYDAx/5fuGP1vElT6jz:S8CRjBhpsuZYDAx/5fuGP1F

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "115"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 309542a3fa9bda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9368"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "325"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "407"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9051"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "17922"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "9368"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "233"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "331"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "8963"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "407"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "9045"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "331"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "8963"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "325"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008eb7972779f95b32072fc5eb5988636bc237f8574ef13e3d6ae8e98140f27a0c000000000e800000000200002000000059ad1d73fed5787c21b26f7ac296dd9de20d76161598c2bb5c5ebb5c4588fbac90000000e227f5f7824eb3517d616c6a566e22d548d96b68bd7ac6273fc071868ca85d796ff4887b753311aa4940d70f8d70c92505cbf97effdcf0cf0f0f2580c1a9a3e39c6fa10b2d5996081699e2cdc74fbb727ea1594d2ba58371d5d983597eac93897f631d5310a9ee741f197150c39d208acabf1f615c9352c676ec53a7a4b2ae1fc17e0a405f7b1e62f7dbe434a212ee61400000006b49fbcfdc4356f537bace06fa23a41b693d16140098e1eb7b055d808296746124f170ea511c8e35710a3d62f4a1298b144d33292f4639cd5143de44a73f2d15	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "492"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "9051"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "17922"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "9368"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "325"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420752204"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "6"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "331"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "407"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "492"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "492"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE
2908	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2908	1656	iexplore.exe	28
PID 1656 wrote to memory of 2908	1656	iexplore.exe	28
PID 1656 wrote to memory of 2908	1656	iexplore.exe	28
PID 1656 wrote to memory of 2908	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c9b8f5945f53a7b4aaedd75720d02cc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2908

Network

DNS

www.noithat190.vn

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.noithat190.vn

IN A

Response

www.noithat190.vn

IN A

27.0.14.98
DNS

code.jquery.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

code.jquery.com

IN A

Response

code.jquery.com

IN A

151.101.130.137

code.jquery.com

IN A

151.101.66.137

code.jquery.com

IN A

151.101.2.137

code.jquery.com

IN A

151.101.194.137
DNS

opi.yahoo.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

opi.yahoo.com

IN A

Response
DNS

s7.addthis.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

s7.addthis.com

IN A

Response

s7.addthis.com

IN CNAME

s8.addthis.com

s8.addthis.com

IN CNAME

ds-s7.addthis.com.edgekey.net

ds-s7.addthis.com.edgekey.net

IN CNAME

e4016.a.akamaiedge.net

e4016.a.akamaiedge.net

IN A

104.68.81.91
GET

http://code.jquery.com/jquery-1.8.2.js

IEXPLORE.EXE

Remote address:

151.101.130.137:80

Request

GET /jquery-1.8.2.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: code.jquery.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Connection: keep-alive
Content-Length: 78587
Server: nginx
Content-Type: application/javascript; charset=utf-8
Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT
ETag: W/"28feccc0-40c02"
Cache-Control: public, max-age=31536000, stale-while-revalidate=604800
Access-Control-Allow-Origin: *
Content-Encoding: gzip
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Wed, 01 May 2024 19:05:38 GMT
Age: 4268290
X-Served-By: cache-lga13627-LGA, cache-lcy-eglc8600078-LCY
X-Cache: HIT, HIT
X-Cache-Hits: 15, 460
X-Timer: S1714590339.848958,VS0,VE0
Vary: Accept-Encoding
GET

http://pagead2.googlesyndication.com/pagead/show_ads.js

IEXPLORE.EXE

Remote address:

216.58.201.98:80

Request

GET /pagead/show_ads.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: pagead2.googlesyndication.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Vary: Accept-Encoding
Date: Wed, 01 May 2024 19:05:38 GMT
Expires: Wed, 01 May 2024 19:05:38 GMT
Cache-Control: private, max-age=3600
Content-Type: text/javascript; charset=UTF-8
ETag: 1728826510982868671
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 14441
X-XSS-Protection: 0
GET

http://s7.addthis.com/js/250/addthis_widget.js

IEXPLORE.EXE

Remote address:

104.68.81.91:80

Request

GET /js/250/addthis_widget.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: s7.addthis.com
Connection: Keep-Alive

Response

HTTP/1.1 308 Permanent Redirect

Server: nginx/1.15.8
Content-Type: text/html
Content-Length: 171
Location: https://s7.addthis.com/js/250/addthis_widget.js
Date: Wed, 01 May 2024 19:05:38 GMT
Connection: keep-alive
X-Distribution: 99
X-Host: s7.addthis.com
DNS

IEXPLORE.EXE

Remote address:

104.68.81.91:80

Response

HTTP/1.0 408 Request Time-out

Server: AkamaiGHost
Mime-Version: 1.0
Date: Wed, 01 May 2024 19:06:13 GMT
Content-Type: text/html
Content-Length: 314
Expires: Wed, 01 May 2024 19:06:13 GMT
GET

http://www.noithat190.vn/components/com_virtuemart/fetchscript.php?gzip=1&subdir[0]=/themes/default&file[0]=theme.js&subdir[1]=/js&file[1]=sleight.js&subdir[2]=/js/mootools&file[2]=mootools-release-1.11.js&subdir[3]=/js/mootools&file[3]=mooPrompt.js&subdir[4]=/js/slimbox/js&file[4]=slimbox.js

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/fetchscript.php?gzip=1&subdir[0]=/themes/default&file[0]=theme.js&subdir[1]=/js&file[1]=sleight.js&subdir[2]=/js/mootools&file[2]=mootools-release-1.11.js&subdir[3]=/js/mootools&file[3]=mooPrompt.js&subdir[4]=/js/slimbox/js&file[4]=slimbox.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn//plugins/system/jatypo/typo/typo.css

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET //plugins/system/jatypo/typo/typo.css HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn//modules/mod_vm_accordion/jquery.js

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET //modules/mod_vm_accordion/jquery.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/ps_image/menu_logo.gif

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/ps_image/menu_logo.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG07_5080e0d33c7e6.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG07_5080e0d33c7e6.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG03_5080df44dc9e4.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG03_5080df44dc9e4.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/fetchscript.php?gzip=1&subdir[0]=/themes/default&file[0]=theme.css&subdir[1]=/js/mootools&file[1]=mooPrompt.css&subdir[2]=/js/slimbox/css&file[2]=slimbox.css

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/fetchscript.php?gzip=1&subdir[0]=/themes/default&file[0]=theme.css&subdir[1]=/js/mootools&file[1]=mooPrompt.css&subdir[2]=/js/slimbox/css&file[2]=slimbox.css HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/0.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/digit_counter/gold/0.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG02_5080df111ff53.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG02_5080df111ff53.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG01_5080ded8be434.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG01_5080ded8be434.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG04_5080df728a632.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG04_5080df728a632.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:41 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/2.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/digit_counter/gold/2.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:39 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/6.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/digit_counter/gold/6.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:39 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vyesterday.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/stats/bags/vyesterday.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vall.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/stats/bags/vall.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG07_5080e0ad08b67.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG07_5080e0ad08b67.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG06_5080e06a39289.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG06_5080e06a39289.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:41 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/1.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/digit_counter/gold/1.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:39 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vtoday.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/stats/bags/vtoday.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:39 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vweek.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/stats/bags/vweek.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vlmonth.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/stats/bags/vlmonth.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG06_5080e0406834c.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG06_5080e0406834c.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_h____50c0052bd24e9.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_h____50c0052bd24e9.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:41 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/8.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/digit_counter/gold/8.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:39 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vmonth.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/stats/bags/vmonth.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG01_5080dead192ff.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG01_5080dead192ff.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG05_5080e01352f82.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG05_5080e01352f82.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG08_5080e0fba68bf.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG08_5080e0fba68bf.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:41 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/7.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/digit_counter/gold/7.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:39 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vlweek.png

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /modules/mod_vvisit_counter/images/stats/bags/vlweek.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG04_5080dfad19c69.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG04_5080dfad19c69.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
GET

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG05_5080dfde6d93f.jpg

IEXPLORE.EXE

Remote address:

27.0.14.98:80

Request

GET /components/com_virtuemart/shop_image/product/Gh____g___p_GG05_5080dfde6d93f.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.noithat190.vn
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

Content-Type: text/html
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
Date: Wed, 01 May 2024 19:05:40 GMT
Content-Length: 1245
DNS

www.youtube.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.youtube.com

IN A

Response

www.youtube.com

IN CNAME

youtube-ui.l.google.com

youtube-ui.l.google.com

IN A

172.217.169.46

youtube-ui.l.google.com

IN A

142.250.179.238

youtube-ui.l.google.com

IN A

142.250.180.14

youtube-ui.l.google.com

IN A

142.250.187.206

youtube-ui.l.google.com

IN A

142.250.187.238

youtube-ui.l.google.com

IN A

142.250.178.14

youtube-ui.l.google.com

IN A

172.217.16.238

youtube-ui.l.google.com

IN A

142.250.200.14

youtube-ui.l.google.com

IN A

142.250.200.46

youtube-ui.l.google.com

IN A

216.58.201.110

youtube-ui.l.google.com

IN A

216.58.204.78

youtube-ui.l.google.com

IN A

216.58.213.14
GET

http://www.youtube.com/embed/CC-Te99LLOg

IEXPLORE.EXE

Remote address:

172.217.169.46:80

Request

GET /embed/CC-Te99LLOg HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: application/binary
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Wed, 01 May 2024 19:05:41 GMT
Location: https://www.youtube.com/embed/CC-Te99LLOg
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
GET

http://www.youtube.com/embed/F16zaOYejkQ

IEXPLORE.EXE

Remote address:

172.217.169.46:80

Request

GET /embed/F16zaOYejkQ HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: application/binary
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Wed, 01 May 2024 19:05:41 GMT
Location: https://www.youtube.com/embed/F16zaOYejkQ
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
GET

https://www.youtube.com/embed/CC-Te99LLOg

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

GET /embed/CC-Te99LLOg HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Wed, 01 May 2024 19:05:41 GMT
Strict-Transport-Security: max-age=31536000
Cross-Origin-Resource-Policy: cross-origin
Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main"
Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
Content-Encoding: gzip
Server: ESF
X-XSS-Protection: 0
Set-Cookie: YSC=KGY3vi_Hmd8; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none
Set-Cookie: VISITOR_INFO1_LIVE=j1FkNw7HPhM; Domain=.youtube.com; Expires=Mon, 28-Oct-2024 19:05:41 GMT; Path=/; Secure; HttpOnly; SameSite=none
Set-Cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgHw%3D%3D; Domain=.youtube.com; Expires=Mon, 28-Oct-2024 19:05:41 GMT; Path=/; Secure; HttpOnly; SameSite=none
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
GET

https://www.youtube.com/s/player/8fc6998a/www-embed-player.vflset/www-embed-player.js

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

GET /s/player/8fc6998a/www-embed-player.vflset/www-embed-player.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive
Cookie: YSC=17wh0h7ZKkA; VISITOR_INFO1_LIVE=qu39hxDFnK0; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgMw%3D%3D

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
Content-Length: 114750
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 30 Apr 2024 07:40:27 GMT
Expires: Wed, 30 Apr 2025 07:40:27 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Tue, 30 Apr 2024 04:19:19 GMT
Content-Type: text/javascript
Vary: Accept-Encoding, Origin
Age: 127514
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1
Accept: */*
X-Goog-Request-Time: 1714590345407
Content-Type: application/json
X-Goog-Visitor-Id: CgtxdTM5aHhERm5LMCiFpcqxBjIKCgJHQhIEGgAgMw%3D%3D
X-YouTube-Client-Name: 56
X-YouTube-Client-Version: 1.20240429.01.00
X-YouTube-Utc-Offset: 0
X-YouTube-Ad-Signals: dt=1714590340797&flash=0&frm=2&u_tz&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&bc=1&bih=-12245933&biw=-12245933&brdim=435%2C1784%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C195%2C150&vis=1&wgl=true&ca_type=image
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: www.youtube.com
Content-Length: 8726
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: YSC=17wh0h7ZKkA; VISITOR_INFO1_LIVE=qu39hxDFnK0; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgMw%3D%3D

Response

HTTP/1.1 200 OK

Content-Type: application/json; charset=UTF-8
Vary: Origin
Vary: X-Origin
Vary: Referer
Content-Encoding: gzip
Date: Wed, 01 May 2024 19:05:46 GMT
Server: scaffolding on HTTPServer2
Cache-Control: private
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
GET

https://www.youtube.com/embed/F16zaOYejkQ

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

GET /embed/F16zaOYejkQ HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8
X-Content-Type-Options: nosniff
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Wed, 01 May 2024 19:05:41 GMT
Strict-Transport-Security: max-age=31536000
Cross-Origin-Resource-Policy: cross-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main"
P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
Content-Encoding: gzip
Server: ESF
X-XSS-Protection: 0
Set-Cookie: YSC=17wh0h7ZKkA; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none
Set-Cookie: VISITOR_INFO1_LIVE=qu39hxDFnK0; Domain=.youtube.com; Expires=Mon, 28-Oct-2024 19:05:41 GMT; Path=/; Secure; HttpOnly; SameSite=none
Set-Cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgMw%3D%3D; Domain=.youtube.com; Expires=Mon, 28-Oct-2024 19:05:41 GMT; Path=/; Secure; HttpOnly; SameSite=none
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
GET

https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/base.js

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

GET /s/player/8fc6998a/player_ias.vflset/en_US/base.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive
Cookie: YSC=17wh0h7ZKkA; VISITOR_INFO1_LIVE=qu39hxDFnK0; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgMw%3D%3D

Response

HTTP/1.1 200 OK

Content-Encoding: gzip
Accept-Ranges: bytes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
Content-Length: 811110
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 30 Apr 2024 07:39:16 GMT
Expires: Wed, 30 Apr 2025 07:39:16 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Tue, 30 Apr 2024 04:19:19 GMT
Content-Type: text/javascript
Vary: Accept-Encoding, Origin
Age: 127585
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/remote.js

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

GET /s/player/8fc6998a/player_ias.vflset/en_US/remote.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive
Cookie: YSC=17wh0h7ZKkA; VISITOR_INFO1_LIVE=qu39hxDFnK0; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgMw%3D%3D

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
Content-Length: 39277
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 30 Apr 2024 07:42:53 GMT
Expires: Wed, 30 Apr 2025 07:42:53 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Tue, 30 Apr 2024 04:19:19 GMT
Content-Type: text/javascript
Vary: Accept-Encoding, Origin
Age: 127370
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/embed.js

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

GET /s/player/8fc6998a/player_ias.vflset/en_US/embed.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive
Cookie: YSC=17wh0h7ZKkA; VISITOR_INFO1_LIVE=qu39hxDFnK0; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgMw%3D%3D

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
Content-Length: 20724
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 30 Apr 2024 07:41:51 GMT
Expires: Wed, 30 Apr 2025 07:41:51 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Tue, 30 Apr 2024 04:19:19 GMT
Content-Type: text/javascript
Vary: Accept-Encoding, Origin
Age: 127432
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/generate_204?1pcaHA

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

GET /generate_204?1pcaHA HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive
Cookie: YSC=17wh0h7ZKkA; VISITOR_INFO1_LIVE=qu39hxDFnK0; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgMw%3D%3D

Response

HTTP/1.1 204 No Content

Content-Length: 0
Cross-Origin-Resource-Policy: cross-origin
Date: Wed, 01 May 2024 19:05:44 GMT
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://www.youtube.com/generate_204?OS5mEg

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

GET /generate_204?OS5mEg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive
Cookie: YSC=17wh0h7ZKkA; VISITOR_INFO1_LIVE=qu39hxDFnK0; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgMw%3D%3D

Response

HTTP/1.1 204 No Content

Content-Length: 0
Cross-Origin-Resource-Policy: cross-origin
Date: Wed, 01 May 2024 19:05:44 GMT
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1
Accept: */*
X-Goog-Request-Time: 1714590345388
Content-Type: application/json
X-Goog-Visitor-Id: CgtqMUZrTnc3SFBoTSiFpcqxBjIKCgJHQhIEGgAgHw%3D%3D
X-YouTube-Client-Name: 56
X-YouTube-Client-Version: 1.20240429.01.00
X-YouTube-Utc-Offset: 0
X-YouTube-Ad-Signals: dt=1714590340784&flash=0&frm=2&u_tz&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&bc=1&bih=-12245933&biw=-12245933&brdim=634%2C1784%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C195%2C150&vis=1&wgl=true&ca_type=image
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: www.youtube.com
Content-Length: 8403
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: YSC=17wh0h7ZKkA; VISITOR_INFO1_LIVE=qu39hxDFnK0; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgMw%3D%3D

Response

HTTP/1.1 200 OK

Content-Type: application/json; charset=UTF-8
Vary: Origin
Vary: X-Origin
Vary: Referer
Content-Encoding: gzip
Date: Wed, 01 May 2024 19:05:46 GMT
Server: scaffolding on HTTPServer2
Cache-Control: private
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
GET

http://www.google-analytics.com/ga.js

IEXPLORE.EXE

Remote address:

142.250.180.14:80

Request

GET /ga.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.google-analytics.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Server: Golfe2
Content-Length: 17168
Date: Wed, 01 May 2024 17:18:33 GMT
Expires: Wed, 01 May 2024 19:18:33 GMT
Cache-Control: public, max-age=7200
Age: 6428
Last-Modified: Tue, 12 Dec 2023 18:09:08 GMT
Content-Type: text/javascript
Vary: Accept-Encoding
GET

https://www.youtube.com/s/player/8fc6998a/www-player.css

IEXPLORE.EXE

Remote address:

172.217.169.46:443

Request

GET /s/player/8fc6998a/www-player.css HTTP/1.1
Accept: text/css, */*
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.youtube.com
Connection: Keep-Alive
Cookie: YSC=KGY3vi_Hmd8; VISITOR_INFO1_LIVE=j1FkNw7HPhM; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgHw%3D%3D

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
Content-Length: 59166
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Tue, 30 Apr 2024 07:40:27 GMT
Expires: Wed, 30 Apr 2025 07:40:27 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Tue, 30 Apr 2024 04:19:19 GMT
Content-Type: text/css
Vary: Accept-Encoding, Origin
Age: 127514
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

googleads.g.doubleclick.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

googleads.g.doubleclick.net

IN A

Response

googleads.g.doubleclick.net

IN A

142.250.187.194
DNS

static.doubleclick.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

static.doubleclick.net

IN A

Response

static.doubleclick.net

IN A

142.250.180.6
GET

https://googleads.g.doubleclick.net/pagead/id

IEXPLORE.EXE

Remote address:

142.250.187.194:443

Request

GET /pagead/id HTTP/1.1
Accept: */*
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: googleads.g.doubleclick.net
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Access-Control-Allow-Credentials: true
Date: Wed, 01 May 2024 19:05:42 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 0
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

IEXPLORE.EXE

Remote address:

142.250.187.194:443

Request

GET /pagead/id?slf_rd=1 HTTP/1.1
Accept: */*
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: googleads.g.doubleclick.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=UTF-8
Date: Wed, 01 May 2024 19:05:42 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
GET

https://googleads.g.doubleclick.net/pagead/id

IEXPLORE.EXE

Remote address:

142.250.187.194:443

Request

GET /pagead/id HTTP/1.1
Accept: */*
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: googleads.g.doubleclick.net
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Access-Control-Allow-Credentials: true
Date: Wed, 01 May 2024 19:05:42 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 0
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

IEXPLORE.EXE

Remote address:

142.250.187.194:443

Request

GET /pagead/id?slf_rd=1 HTTP/1.1
Accept: */*
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: googleads.g.doubleclick.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=UTF-8
Date: Wed, 01 May 2024 19:05:42 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
GET

https://static.doubleclick.net/instream/ad_status.js

IEXPLORE.EXE

Remote address:

142.250.180.6:443

Request

GET /instream/ad_status.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.doubleclick.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media"
Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
Timing-Allow-Origin: *
Content-Length: 29
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Wed, 01 May 2024 19:03:52 GMT
Expires: Wed, 01 May 2024 19:18:52 GMT
Cache-Control: public, max-age=900
Age: 110
Last-Modified: Thu, 12 Dec 2013 23:40:16 GMT
Content-Type: text/javascript
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

jnn-pa.googleapis.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

jnn-pa.googleapis.com

IN A

Response

jnn-pa.googleapis.com

IN A

142.250.180.10

jnn-pa.googleapis.com

IN A

142.250.187.202

jnn-pa.googleapis.com

IN A

142.250.187.234

jnn-pa.googleapis.com

IN A

142.250.178.10

jnn-pa.googleapis.com

IN A

172.217.16.234

jnn-pa.googleapis.com

IN A

142.250.200.10

jnn-pa.googleapis.com

IN A

142.250.200.42

jnn-pa.googleapis.com

IN A

216.58.201.106

jnn-pa.googleapis.com

IN A

216.58.204.74

jnn-pa.googleapis.com

IN A

216.58.213.10

jnn-pa.googleapis.com

IN A

216.58.212.202

jnn-pa.googleapis.com

IN A

216.58.212.234

jnn-pa.googleapis.com

IN A

172.217.169.74

jnn-pa.googleapis.com

IN A

172.217.169.42

jnn-pa.googleapis.com

IN A

142.250.179.234
POST

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

IEXPLORE.EXE

Remote address:

142.250.180.10:443

Request

POST /$rpc/google.internal.waa.v1.Waa/Create HTTP/1.1
Accept: */*
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: jnn-pa.googleapis.com
Content-Length: 24
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Content-Type: application/json+protobuf; charset=UTF-8
Vary: Origin
Vary: X-Origin
Vary: Referer
Content-Encoding: gzip
Date: Wed, 01 May 2024 19:05:44 GMT
Server: ESF
Cache-Control: private
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
POST

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

IEXPLORE.EXE

Remote address:

142.250.180.10:443

Request

POST /$rpc/google.internal.waa.v1.Waa/GenerateIT HTTP/1.1
Accept: */*
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: jnn-pa.googleapis.com
Content-Length: 1068
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Content-Type: application/json+protobuf; charset=UTF-8
Vary: Origin
Vary: X-Origin
Vary: Referer
Content-Encoding: gzip
Date: Wed, 01 May 2024 19:05:44 GMT
Server: ESF
Cache-Control: private
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
DNS

www.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.178.4
DNS

i.ytimg.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

i.ytimg.com

IN A

Response

i.ytimg.com

IN A

172.217.16.246

i.ytimg.com

IN A

142.250.200.22

i.ytimg.com

IN A

142.250.200.54

i.ytimg.com

IN A

216.58.201.118

i.ytimg.com

IN A

216.58.204.86

i.ytimg.com

IN A

216.58.213.22

i.ytimg.com

IN A

142.250.179.246

i.ytimg.com

IN A

142.250.180.22

i.ytimg.com

IN A

142.250.187.214

i.ytimg.com

IN A

142.250.187.246

i.ytimg.com

IN A

142.250.178.22
GET

https://www.google.com/js/th/HJLpC_KsHO9WNnzI89ITV8EL_3UMlOCJVEGkvNJwaGU.js

IEXPLORE.EXE

Remote address:

142.250.178.4:443

Request

GET /js/th/HJLpC_KsHO9WNnzI89ITV8EL_3UMlOCJVEGkvNJwaGU.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.google.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs"
Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
Content-Length: 23819
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 27 Apr 2024 01:54:57 GMT
Expires: Sun, 27 Apr 2025 01:54:57 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Tue, 23 Apr 2024 17:30:00 GMT
Content-Type: text/javascript
Vary: Accept-Encoding
Age: 407446
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://i.ytimg.com/vi/F16zaOYejkQ/default.jpg

IEXPLORE.EXE

Remote address:

172.217.16.246:443

Request

GET /vi/F16zaOYejkQ/default.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: i.ytimg.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
Timing-Allow-Origin: *
Content-Length: 4875
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Wed, 01 May 2024 18:23:31 GMT
Expires: Wed, 01 May 2024 20:23:31 GMT
Cache-Control: public, max-age=7200
Age: 2532
ETag: "0"
Content-Type: image/jpeg
Vary: Origin
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://i.ytimg.com/vi/CC-Te99LLOg/default.jpg?sqp=-oaymwEkCHgQWvKriqkDGvABAfgB3gOAAugCigIMCAAQARhlIF0oQjAP&rs=AOn4CLCHu4iUNQ4DWeFJ0qIX5tJMfDvuKw

IEXPLORE.EXE

Remote address:

172.217.16.246:443

Request

GET /vi/CC-Te99LLOg/default.jpg?sqp=-oaymwEkCHgQWvKriqkDGvABAfgB3gOAAugCigIMCAAQARhlIF0oQjAP&rs=AOn4CLCHu4iUNQ4DWeFJ0qIX5tJMfDvuKw HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: i.ytimg.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Type: image/jpeg
Vary: Origin
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
Timing-Allow-Origin: *
Content-Length: 2775
Date: Wed, 01 May 2024 19:05:43 GMT
Expires: Wed, 01 May 2024 21:05:43 GMT
Cache-Control: public, max-age=7200
ETag: "1351154685"
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
POST

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

IEXPLORE.EXE

Remote address:

142.250.180.10:443

Request

POST /$rpc/google.internal.waa.v1.Waa/Create HTTP/1.1
Accept: */*
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: jnn-pa.googleapis.com
Content-Length: 24
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Content-Type: application/json+protobuf; charset=UTF-8
Vary: Origin
Vary: X-Origin
Vary: Referer
Content-Encoding: gzip
Date: Wed, 01 May 2024 19:05:44 GMT
Server: ESF
Cache-Control: private
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
POST

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

IEXPLORE.EXE

Remote address:

142.250.180.10:443

Request

POST /$rpc/google.internal.waa.v1.Waa/GenerateIT HTTP/1.1
Accept: */*
X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
Content-Type: application/json+protobuf
X-User-Agent: grpc-web-javascript/0.1
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: jnn-pa.googleapis.com
Content-Length: 1007
Connection: Keep-Alive
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Content-Type: application/json+protobuf; charset=UTF-8
Vary: Origin
Vary: X-Origin
Vary: Referer
Content-Encoding: gzip
Date: Wed, 01 May 2024 19:05:44 GMT
Server: ESF
Cache-Control: private
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
DNS

yt3.ggpht.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

yt3.ggpht.com

IN A

Response

yt3.ggpht.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.178.1
GET

https://yt3.ggpht.com/ytc/AIdro_lZWYFNMNy6UPMUtINROSVqLM0C_66Q7RpGGVQssX9BKLg=s68-c-k-c0x00ffffff-no-rj

IEXPLORE.EXE

Remote address:

142.250.178.1:443

Request

GET /ytc/AIdro_lZWYFNMNy6UPMUtINROSVqLM0C_66Q7RpGGVQssX9BKLg=s68-c-k-c0x00ffffff-no-rj HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: yt3.ggpht.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="unnamed.jpg"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 3881
X-XSS-Protection: 0
Date: Wed, 01 May 2024 18:23:31 GMT
Expires: Thu, 02 May 2024 18:23:31 GMT
Cache-Control: public, max-age=86400, no-transform
Age: 2533
ETag: "vc3"
Content-Type: image/jpeg
Vary: Origin
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

fe0.google.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

fe0.google.com

IN A

Response
DNS

tpc.googlesyndication.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

tpc.googlesyndication.com

IN A

Response

tpc.googlesyndication.com

IN A

142.250.200.33
GET

https://tpc.googlesyndication.com/sodar/sodar2.js

IEXPLORE.EXE

Remote address:

142.250.200.33:443

Request

GET /sodar/sodar2.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: tpc.googlesyndication.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="adspam-signals-scs"
Report-To: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
Date: Wed, 01 May 2024 19:05:46 GMT
Expires: Wed, 01 May 2024 19:05:46 GMT
Cache-Control: private, max-age=3000
ETag: "1637097310169751"
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
GET

https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

IEXPLORE.EXE

Remote address:

142.250.200.33:443

Request

GET /sodar/sodar2/225/runner.html HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: tpc.googlesyndication.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="adspam-signals-scs"
Report-To: {"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
Content-Length: 5046
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Wed, 01 May 2024 18:48:09 GMT
Expires: Thu, 01 May 2025 18:48:09 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Mon, 21 Jun 2021 20:47:05 GMT
Content-Type: text/html
Vary: Accept-Encoding
Age: 1057
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://tpc.googlesyndication.com/generate_204?ij9tvg

IEXPLORE.EXE

Remote address:

142.250.200.33:443

Request

GET /generate_204?ij9tvg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Referer: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: tpc.googlesyndication.com
Connection: Keep-Alive

Response

HTTP/1.1 204 No Content

Content-Length: 0
Cross-Origin-Resource-Policy: cross-origin
Date: Wed, 01 May 2024 19:05:46 GMT
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

2.21.17.194
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

2.21.17.194
GET

https://googleads.g.doubleclick.net/pagead/id

IEXPLORE.EXE

Remote address:

142.250.187.194:443

Request

GET /pagead/id HTTP/1.1
Accept: */*
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: googleads.g.doubleclick.net
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Access-Control-Allow-Credentials: true
Date: Wed, 01 May 2024 19:07:44 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 0
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

IEXPLORE.EXE

Remote address:

142.250.187.194:443

Request

GET /pagead/id?slf_rd=1 HTTP/1.1
Accept: */*
Referer: https://www.youtube.com/embed/CC-Te99LLOg
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: googleads.g.doubleclick.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=UTF-8
Date: Wed, 01 May 2024 19:07:44 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
GET

https://googleads.g.doubleclick.net/pagead/id

IEXPLORE.EXE

Remote address:

142.250.187.194:443

Request

GET /pagead/id HTTP/1.1
Accept: */*
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: googleads.g.doubleclick.net
Connection: Keep-Alive

Response

HTTP/1.1 302 Found

P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
Access-Control-Allow-Credentials: true
Date: Wed, 01 May 2024 19:07:44 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 0
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

IEXPLORE.EXE

Remote address:

142.250.187.194:443

Request

GET /pagead/id?slf_rd=1 HTTP/1.1
Accept: */*
Referer: https://www.youtube.com/embed/F16zaOYejkQ
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Host: googleads.g.doubleclick.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Timing-Allow-Origin: *
Cross-Origin-Resource-Policy: cross-origin
Access-Control-Allow-Credentials: true
Content-Type: application/json; charset=UTF-8
Date: Wed, 01 May 2024 19:07:44 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
X-XSS-Protection: 0
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked

151.101.130.137:80

http://code.jquery.com/jquery-1.8.2.js

http

IEXPLORE.EXE

1.9kB
82.2kB
36
64

HTTP Request

GET http://code.jquery.com/jquery-1.8.2.js

HTTP Response

200
151.101.130.137:80

code.jquery.com

IEXPLORE.EXE

242 B
184 B
5
4
216.58.201.98:80

http://pagead2.googlesyndication.com/pagead/show_ads.js

http

IEXPLORE.EXE

830 B
15.6kB
12
15

HTTP Request

GET http://pagead2.googlesyndication.com/pagead/show_ads.js

HTTP Response

200
216.58.201.98:80

pagead2.googlesyndication.com

IEXPLORE.EXE

190 B
92 B
4
2
104.68.81.91:80

http://s7.addthis.com/js/250/addthis_widget.js

http

IEXPLORE.EXE

603 B
1.1kB
7
6

HTTP Request

GET http://s7.addthis.com/js/250/addthis_widget.js

HTTP Response

308
104.68.81.91:80

s7.addthis.com

http

IEXPLORE.EXE

340 B
746 B
7
5

HTTP Response

408
27.0.14.98:80

http://www.noithat190.vn/components/com_virtuemart/fetchscript.php?gzip=1&subdir[0]=/themes/default&file[0]=theme.js&subdir[1]=/js&file[1]=sleight.js&subdir[2]=/js/mootools&file[2]=mootools-release-1.11.js&subdir[3]=/js/mootools&file[3]=mooPrompt.js&subdir[4]=/js/slimbox/js&file[4]=slimbox.js

http

IEXPLORE.EXE

1.4kB
1.6kB
9
5

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/fetchscript.php?gzip=1&subdir[0]=/themes/default&file[0]=theme.js&subdir[1]=/js&file[1]=sleight.js&subdir[2]=/js/mootools&file[2]=mootools-release-1.11.js&subdir[3]=/js/mootools&file[3]=mooPrompt.js&subdir[4]=/js/slimbox/js&file[4]=slimbox.js

HTTP Response

404
27.0.14.98:80

http://www.noithat190.vn//plugins/system/jatypo/typo/typo.css

http

IEXPLORE.EXE

936 B
1.6kB
9
5

HTTP Request

GET http://www.noithat190.vn//plugins/system/jatypo/typo/typo.css

HTTP Response

404
27.0.14.98:80

http://www.noithat190.vn//modules/mod_vm_accordion/jquery.js

http

IEXPLORE.EXE

882 B
1.5kB
7
3

HTTP Request

GET http://www.noithat190.vn//modules/mod_vm_accordion/jquery.js

HTTP Response

404
27.0.14.98:80

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG03_5080df44dc9e4.jpg

http

IEXPLORE.EXE

1.8kB
4.5kB
10
7

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/ps_image/menu_logo.gif

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG07_5080e0d33c7e6.jpg

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG03_5080df44dc9e4.jpg

HTTP Response

404
27.0.14.98:80

http://www.noithat190.vn/components/com_virtuemart/fetchscript.php?gzip=1&subdir[0]=/themes/default&file[0]=theme.css&subdir[1]=/js/mootools&file[1]=mooPrompt.css&subdir[2]=/js/slimbox/css&file[2]=slimbox.css

http

IEXPLORE.EXE

1.2kB
1.6kB
9
5

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/fetchscript.php?gzip=1&subdir[0]=/themes/default&file[0]=theme.css&subdir[1]=/js/mootools&file[1]=mooPrompt.css&subdir[2]=/js/slimbox/css&file[2]=slimbox.css

HTTP Response

404
27.0.14.98:80

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG04_5080df728a632.jpg

http

IEXPLORE.EXE

2.3kB
6.0kB
13
10

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/0.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG02_5080df111ff53.jpg

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG01_5080ded8be434.jpg

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG04_5080df728a632.jpg

HTTP Response

404
27.0.14.98:80

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG06_5080e06a39289.jpg

http

IEXPLORE.EXE

2.6kB
9.0kB
15
13

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/2.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/6.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vyesterday.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vall.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG07_5080e0ad08b67.jpg

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG06_5080e06a39289.jpg

HTTP Response

404
27.0.14.98:80

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_h____50c0052bd24e9.jpg

http

IEXPLORE.EXE

2.7kB
9.0kB
16
14

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/1.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vtoday.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vweek.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vlmonth.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG06_5080e0406834c.jpg

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_h____50c0052bd24e9.jpg

HTTP Response

404
27.0.14.98:80

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG08_5080e0fba68bf.jpg

http

IEXPLORE.EXE

2.3kB
7.5kB
14
12

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/8.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vmonth.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG01_5080dead192ff.jpg

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG05_5080e01352f82.jpg

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG08_5080e0fba68bf.jpg

HTTP Response

404
27.0.14.98:80

http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG05_5080dfde6d93f.jpg

http

IEXPLORE.EXE

1.8kB
6.0kB
11
9

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/digit_counter/gold/7.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/modules/mod_vvisit_counter/images/stats/bags/vlweek.png

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG04_5080dfad19c69.jpg

HTTP Response

404

HTTP Request

GET http://www.noithat190.vn/components/com_virtuemart/shop_image/product/Gh____g___p_GG05_5080dfde6d93f.jpg

HTTP Response

404
172.217.169.46:80

http://www.youtube.com/embed/CC-Te99LLOg

http

IEXPLORE.EXE

543 B
566 B
6
4

HTTP Request

GET http://www.youtube.com/embed/CC-Te99LLOg

HTTP Response

301
172.217.169.46:80

http://www.youtube.com/embed/F16zaOYejkQ

http

IEXPLORE.EXE

595 B
1.0kB
7
5

HTTP Request

GET http://www.youtube.com/embed/F16zaOYejkQ

HTTP Response

301
172.217.169.46:443

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

tls, http

IEXPLORE.EXE

14.6kB
176.1kB
84
144

HTTP Request

GET https://www.youtube.com/embed/CC-Te99LLOg

HTTP Response

200

HTTP Request

GET https://www.youtube.com/s/player/8fc6998a/www-embed-player.vflset/www-embed-player.js

HTTP Response

200

HTTP Request

POST https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

HTTP Response

200
172.217.169.46:443

https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

tls, http

IEXPLORE.EXE

33.5kB
973.7kB
430
725

HTTP Request

GET https://www.youtube.com/embed/F16zaOYejkQ

HTTP Response

200

HTTP Request

GET https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/base.js

HTTP Response

200

HTTP Request

GET https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/remote.js

HTTP Response

200

HTTP Request

GET https://www.youtube.com/s/player/8fc6998a/player_ias.vflset/en_US/embed.js

HTTP Response

200

HTTP Request

GET https://www.youtube.com/generate_204?1pcaHA

HTTP Response

204

HTTP Request

GET https://www.youtube.com/generate_204?OS5mEg

HTTP Response

204

HTTP Request

POST https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

HTTP Response

200
142.250.180.14:80

http://www.google-analytics.com/ga.js

http

IEXPLORE.EXE

858 B
18.3kB
13
16

HTTP Request

GET http://www.google-analytics.com/ga.js

HTTP Response

200
142.250.180.14:80

www.google-analytics.com

IEXPLORE.EXE

190 B
92 B
4
2
27.0.14.98:80

www.noithat190.vn

IEXPLORE.EXE

140 B
88 B
3
2
172.217.169.46:443

https://www.youtube.com/s/player/8fc6998a/www-player.css

tls, http

IEXPLORE.EXE

2.1kB
63.4kB
31
51

HTTP Request

GET https://www.youtube.com/s/player/8fc6998a/www-player.css

HTTP Response

200
142.250.187.194:443

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

tls, http

IEXPLORE.EXE

1.4kB
6.7kB
11
13

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/id

HTTP Response

302

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

HTTP Response

200
142.250.187.194:443

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

tls, http

IEXPLORE.EXE

1.4kB
6.7kB
11
13

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/id

HTTP Response

302

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

HTTP Response

200
142.250.180.6:443

static.doubleclick.net

tls

IEXPLORE.EXE

759 B
5.0kB
10
9
142.250.180.6:443

https://static.doubleclick.net/instream/ad_status.js

tls, http

IEXPLORE.EXE

1.1kB
6.5kB
10
10

HTTP Request

GET https://static.doubleclick.net/instream/ad_status.js

HTTP Response

200
142.250.180.10:443

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

tls, http

IEXPLORE.EXE

3.9kB
51.0kB
31
47

HTTP Request

POST https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

HTTP Response

200

HTTP Request

POST https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

HTTP Response

200
142.250.178.4:443

www.google.com

tls

IEXPLORE.EXE

975 B
4.6kB
15
8
142.250.178.4:443

https://www.google.com/js/th/HJLpC_KsHO9WNnzI89ITV8EL_3UMlOCJVEGkvNJwaGU.js

tls, http

IEXPLORE.EXE

1.5kB
30.6kB
19
27

HTTP Request

GET https://www.google.com/js/th/HJLpC_KsHO9WNnzI89ITV8EL_3UMlOCJVEGkvNJwaGU.js

HTTP Response

200
172.217.16.246:443

https://i.ytimg.com/vi/CC-Te99LLOg/default.jpg?sqp=-oaymwEkCHgQWvKriqkDGvABAfgB3gOAAugCigIMCAAQARhlIF0oQjAP&rs=AOn4CLCHu4iUNQ4DWeFJ0qIX5tJMfDvuKw

tls, http

IEXPLORE.EXE

1.9kB
14.8kB
15
18

HTTP Request

GET https://i.ytimg.com/vi/F16zaOYejkQ/default.jpg

HTTP Response

200

HTTP Request

GET https://i.ytimg.com/vi/CC-Te99LLOg/default.jpg?sqp=-oaymwEkCHgQWvKriqkDGvABAfgB3gOAAugCigIMCAAQARhlIF0oQjAP&rs=AOn4CLCHu4iUNQ4DWeFJ0qIX5tJMfDvuKw

HTTP Response

200
172.217.16.246:443

i.ytimg.com

tls

IEXPLORE.EXE

726 B
5.2kB
9
9
142.250.180.10:443

https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

tls, http

IEXPLORE.EXE

3.7kB
46.6kB
29
43

HTTP Request

POST https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

HTTP Response

200

HTTP Request

POST https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

HTTP Response

200
142.250.178.1:443

yt3.ggpht.com

tls

IEXPLORE.EXE

750 B
9.7kB
10
12
142.250.178.1:443

https://yt3.ggpht.com/ytc/AIdro_lZWYFNMNy6UPMUtINROSVqLM0C_66Q7RpGGVQssX9BKLg=s68-c-k-c0x00ffffff-no-rj

tls, http

IEXPLORE.EXE

1.3kB
14.3kB
12
16

HTTP Request

GET https://yt3.ggpht.com/ytc/AIdro_lZWYFNMNy6UPMUtINROSVqLM0C_66Q7RpGGVQssX9BKLg=s68-c-k-c0x00ffffff-no-rj

HTTP Response

200
142.250.200.33:443

tpc.googlesyndication.com

tls

IEXPLORE.EXE

710 B
4.7kB
9
8
142.250.200.33:443

https://tpc.googlesyndication.com/generate_204?ij9tvg

tls, http

IEXPLORE.EXE

2.1kB
18.8kB
17
22

HTTP Request

GET https://tpc.googlesyndication.com/sodar/sodar2.js

HTTP Response

200

HTTP Request

GET https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html

HTTP Response

200

HTTP Request

GET https://tpc.googlesyndication.com/generate_204?ij9tvg

HTTP Response

204
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

799 B
7.7kB
10
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

799 B
7.7kB
10
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.6kB
9
12
142.250.187.194:443

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

tls, http

IEXPLORE.EXE

1.2kB
2.1kB
7
8

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/id

HTTP Response

302

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

HTTP Response

200
142.250.187.194:443

https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

tls, http

IEXPLORE.EXE

1.2kB
2.3kB
7
8

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/id

HTTP Response

302

HTTP Request

GET https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

HTTP Response

200

8.8.8.8:53

www.noithat190.vn

dns

IEXPLORE.EXE

63 B
79 B
1
1

DNS Request

www.noithat190.vn

DNS Response

27.0.14.98
8.8.8.8:53

code.jquery.com

dns

IEXPLORE.EXE

61 B
125 B
1
1

DNS Request

code.jquery.com

DNS Response

151.101.130.137

151.101.66.137

151.101.2.137

151.101.194.137
8.8.8.8:53

opi.yahoo.com

dns

IEXPLORE.EXE

59 B
120 B
1
1

DNS Request

opi.yahoo.com
8.8.8.8:53

s7.addthis.com

dns

IEXPLORE.EXE

60 B
169 B
1
1

DNS Request

s7.addthis.com

DNS Response

104.68.81.91
8.8.8.8:53

www.youtube.com

dns

IEXPLORE.EXE

61 B
287 B
1
1

DNS Request

www.youtube.com

DNS Response

172.217.169.46

142.250.179.238

142.250.180.14

142.250.187.206

142.250.187.238

142.250.178.14

172.217.16.238

142.250.200.14

142.250.200.46

216.58.201.110

216.58.204.78

216.58.213.14
8.8.8.8:53

googleads.g.doubleclick.net

dns

IEXPLORE.EXE

73 B
89 B
1
1

DNS Request

googleads.g.doubleclick.net

DNS Response

142.250.187.194
8.8.8.8:53

static.doubleclick.net

dns

IEXPLORE.EXE

68 B
84 B
1
1

DNS Request

static.doubleclick.net

DNS Response

142.250.180.6
8.8.8.8:53

jnn-pa.googleapis.com

dns

IEXPLORE.EXE

67 B
307 B
1
1

DNS Request

jnn-pa.googleapis.com

DNS Response

142.250.180.10

142.250.187.202

142.250.187.234

142.250.178.10

172.217.16.234

142.250.200.10

142.250.200.42

216.58.201.106

216.58.204.74

216.58.213.10

216.58.212.202

216.58.212.234

172.217.169.74

172.217.169.42

142.250.179.234
8.8.8.8:53

www.google.com

dns

IEXPLORE.EXE

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.178.4
8.8.8.8:53

i.ytimg.com

dns

IEXPLORE.EXE

57 B
233 B
1
1

DNS Request

i.ytimg.com

DNS Response

172.217.16.246

142.250.200.22

142.250.200.54

216.58.201.118

216.58.204.86

216.58.213.22

142.250.179.246

142.250.180.22

142.250.187.214

142.250.187.246

142.250.178.22
8.8.8.8:53

yt3.ggpht.com

dns

IEXPLORE.EXE

59 B
120 B
1
1

DNS Request

yt3.ggpht.com

DNS Response

142.250.178.1
8.8.8.8:53

fe0.google.com

dns

IEXPLORE.EXE

60 B
110 B
1
1

DNS Request

fe0.google.com
8.8.8.8:53

tpc.googlesyndication.com

dns

IEXPLORE.EXE

71 B
87 B
1
1

DNS Request

tpc.googlesyndication.com

DNS Response

142.250.200.33
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

2.21.17.194
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

2.21.17.194

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
342906e34b8ccc1ea256a817ff390aba

SHA1
aefe1a389284cc4420b45c773f8c03bf3c454dc9

SHA256
3cadf4227f31d5bdb0a038e06cafad075afc2ef9b04b71f91c651d0e87cd51eb

SHA512
0a66203c2f32b6a154103f421306206c9aa99b4b6592bbcdff100935dccda3d1afd214aa984683b3d32f9f6ad8c66f24f30f9f8b49d2a4dbdb7185f62dfa5304

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8b0c4821ebccd8da62fecf5c5b8195a

SHA1
beb53bbf7065c801fd4ffa83ac4aeaf7f7220c70

SHA256
a1fcd82acc280b7299580981f777578bb016c95d5dabadb47d93c2f058a647b9

SHA512
a8cf02939723bd555d72456bed48d11295a508d394269f18be5bba0db4bfa389d87650b627514c924a66e2e6fb16291a336320818e21dc72f0c369031cec44d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ed8c5fefe1479af65c0633cbd70cef74

SHA1
3b626496015c89342fd9eda8fbb4a2dd581b8ea9

SHA256
12b79651ab42fbf85570d237c4da2ecc27155a64d190ef284903f0c4ce843368

SHA512
febf2994503db7a76c29d84e15743659d186c4445b5519be5cc0071ac6abb6e8f7ee4abec149d72fdf2b63b0708824d350d44225b116c4fd933c581310aa706a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0715b887fd7715b83ad9d19ff6b53ca

SHA1
5b34101894f135938711ba5a3c753486a383a80e

SHA256
b5f2e3639d1d5c87e2b771e2475fea4d3a25db68887921ec6c54b2d03bb66bd9

SHA512
829d43b9a468773c2a63ac20aae038a535231d665bb1c926ee9cc7269879ec8fcac61977f800ab268859c6b7615c0e5edff948496e756b3877fb65d4afd542c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
728e7eea3001ae2b503a3be4c51bd4dd

SHA1
7ed232757b1e8cd8cba89a43e0bc70b70d8fb6a9

SHA256
20884010bf1111cc11bd13a98a25912c64b3bd5c1187e4a2171311e4d08ef2cc

SHA512
19f711649b074bad6f587115e129a0c3f0233f3dbec79bb9356e2c819c5f68cf42b16464939de8db219615fd2e732a78e2057d7fa6e54fd60724340fce3b7ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83891cd668a6e6e8d1d88fa57be7502c

SHA1
786fd9def52b9537e143e1beca13feec5b7565a4

SHA256
99c3becfe96c74267421a994eb996295be3e310216d41f2fcc4c9b58cc3ce661

SHA512
cac5a102057743ac02ff36aa371f9d0d8a9c28590d3c3c658ed1efb47ddc5c4f9f488b0192b611a8096838d9fd175f4cd0b66a6ca0af21b8311321208d80d7f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c32bc6dd1d7ea272171fed293e49f03c

SHA1
45bdc00cdbffa45a419abaff49b8a4b5ec394cb4

SHA256
9d739a4173585259a2ca2e22e87090c24faefafa03103325841c884d6c506c34

SHA512
f6fa06cf15bbbb4d76cb6de941959e4cca2e07874ec4045cf585633013f921e5d5304e363abfc2c3ad0a1b03a66e9086581271069fda16b1a67b2f4529400fe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ac4a0ecd75ba567fdd7a23bc3df69fe0

SHA1
66f03b970f461769a96fd7b0decc385e0d0409af

SHA256
49ae4fd25f2332ca3e5a84e1e19c3f84d07d08e88903422023f2943951e43d21

SHA512
aa28b15feec0917b75a684992f221b36abf8841df722ed8eba3209d364abea4c8e3e1b3b996c12a02a0d34e4bc317ea42eace88f69a6cf57d42ad98e99757113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
722eb81d6e4eaa2b2f9f059a10e8712a

SHA1
37344db53465faf385a7c6c8be80057d8c986355

SHA256
fdea427243ff6880a2e6b8d0fd429d2a60b3243ed7b65904c9836182ddfa1366

SHA512
5313dd16930c0b4fb6692bc4560fcfe7f2cf60504e040c227eff5a36a462fc622f6e08d273bfbe343d16e40ba2a5e50b321bed71c626d6911973c38cf08cb7a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eb21d8d275a12df033922fa9b94fe9c8

SHA1
4a41613a9f5d8f613ddd84904e60fab407499a89

SHA256
208dd55283a223db04b4addb774c3956592d3152f3efa90a95a598c4189b88b2

SHA512
a28a88ad20b804c822cd2523a8aa83f698e4a3eee83a2a9d05e6459c19775316856e31f862ac83a80ca8e9a7539511f01dcec6c8a5358873d6135ed8646bfbb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
024d71263f5308d25f4831d29845c8e2

SHA1
8a06f95bbf594f1840f42f0899dde3dff5c6ed31

SHA256
51dacabf85646a8a0168dc9344d179e65643ff3b5de809bb4791fe8853951a96

SHA512
f994dd378892cd1f3fa16fc922b3a4c9bea3a2e2e514970ddddb1812eab96ae7cde6338db179af8ba41176e3d8829cfd1407e9cccb16b5ae35b523919457260c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e88b43aece9b90d277c37f79e8af13b

SHA1
989a1aebf7c97b31e40fe767f58b70504b16ba4f

SHA256
ce1f1bfcbacd2d2c54f6a7f99ac80520fd0aff8847604f825ba63f26d430a456

SHA512
83d6c0c552c5356e8ee06cb6357a08693b71e1ef375d3c563300129f1ada48a22e68fc010afabb31866ca77896021d429e5d183f6aed2e4622eee3e92b6ae868

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
584fe266b4c973794a29fbf0202f699b

SHA1
f71794ddd3f05e1789e2c19b847a4f69f671c5cc

SHA256
cd9b6432a4cdaa2b4dc953ee016127d85a32504e3a335abd583e174d1f476cb7

SHA512
3cce04172c51bf67918ea9722814d33e8361a75ba0ea7a53c23f442843f296f16cf9eab226ce26f1363a53acc166976296d6166e0053368a8bfe975adc488a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ffc97caa4077de3236940847276d560

SHA1
68837f44973268b7ffc6797622ca6bc49526af47

SHA256
be43d7109d9433c4c558bf9845bf3831ce9e343fa624628b6436a9fe30d841a7

SHA512
7552cfe9e70742ad03ad2d9f5b8ce6be56a137dea0957e56e09175dcf1b3ef67ac788986028d82ecb5e9cfaeacca69606fe9d23846237edaf5022e199e4b5833

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c46263b51371e76f2514dcc71be8d5ea

SHA1
e315de89d75310cad30d2cffa65502c6d39c8053

SHA256
59858eafd528bf13276229f4365cfded13cf9e5605c82235bf64412c8d0a0a4b

SHA512
97df8db3501cdd5585ab30a608f5922ed41e823ba38ea35ac470921eed1759c84137380561ac3b7e088fb31fd521a522d892f4f5836bbec9f9dcb390b1469474

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
889e079c1b78bbfa865cde079279bedc

SHA1
7ffd4b578fba6fe30dca26229403ae0af664d08f

SHA256
5dd8e720f3b78ac08ded1e884f06477d944ab69469c5f32d8cb2a2047897f5a7

SHA512
812a6929dd0b3b37ac54238d8badc7f619a3d4ac729076632029d3822db5df99492256180fa457a0e09ccbd85f43e795acfab4366b22cb787d9e36bd294c50ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4bce803cb9b35add957f6f050ba706d8

SHA1
68f28449f9d6b7fb1bde4e16a56ac2307a77828c

SHA256
d28d825384d5fc2a44839306aec2fc4fc85892b8cedc37ad9de38297cd522ba3

SHA512
034f1bfb8c7bff2d945c88acaaa8223a9b737bde3eb5cafa06c0af11575ce753d46f8285dcd92796d5126259d53fdbfd637dd50e4e96cd50f41c954a273d9a39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
20de4d9fc9271e746cf6d3068ec5acc0

SHA1
32b704076743d504a71f472c8ff7f31262bbb51b

SHA256
deb5a5efe5f5ec174843164b4428ed2a57d9d87d7e80efc66ef0d4eb05bb8e2c

SHA512
412870c64c81d99c2530d046c845b9598bcb013bd59f20a644924990d6cea66f22d99197761bd52d2384fbcd86af16b4003951423bb5f7bc75daa22b2bd3a4d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6951bf549a826bf19b25efdc059e837

SHA1
823d01de0112213f24a5c254a645f7dd3607147c

SHA256
9ec5f3af6a5f0f412cc17bce2139c6ce688af77f1639b2bc55f2603d87c7d6be

SHA512
cc8f0c1122efbad18e82ea39913772d76872a7aa5baa09272ab2c777c674a8db12e8a4e8695b047337063f43e0b16e029ec4b251e163af2331b880af8a022306

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f9d5974fdb3e0e1a328d3609abeb549

SHA1
399e58cf57cec55988b52c8d8a46bf8f8c647c71

SHA256
7a3ed2da9766ba15d6c290b11bb73b8a8a1e8414c97762c7cd56262eadb0bcd6

SHA512
1f204b49ece12c6759047c17bd131e599e0e999032e7b84ad9638a457ffddc281df4ced94bdae47a83fa0934402a82858ba47f92e0143a6548f9291621550670

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
71bc3654db0d0a334798287ed25e9f1e

SHA1
146a64ee7bd33acb171d4ae7af58db3d8e5e8613

SHA256
05d6f4b7fd2d80e7988cf60ffe2ff3792a8a1656fce96048064e879f24497f89

SHA512
1da549cdf0969aca52f4a3e81437e0501aff3b4ba8f907f9d757f2fe61e3df2019aec209a5a0b84d0085f32b085496d59c0a3f1ece7fb4c0810d812d4e1d2218

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b8df3415e3af8441a31de99c485149d9

SHA1
3c17e0fdbe532042adae718d82ab094a2624f7e8

SHA256
f7e4d3fb08dd34e523958e19075b08e3f15f4a38ee55e680f81be4b3459f86b2

SHA512
c40c2d21843e1cc97d9acb488bd254c379a08969df87d8edc6627212f9f5e13050957ea4c738438b5e0669fc60f4f6da87af85b049d19bb0fc19cf4f4e0597db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
229B

MD5
9c83ca818b2fc60d8c61c6d9bff983ff

SHA1
95c53b6e2ad71cdb97d23a1735ca012be39a9dd8

SHA256
e407db25653b5f5416b9d63dc59b9394e5c5834be63c8d6be5ac8cb10007c1f5

SHA512
c8e43fc7ff8032c86e00fea4fdbda21a866762f5bdc7d93ca0d07d27be93cbc6b6a4805bdf608352df4f04ad8d0e41d1a938be48ad64b8d4b72771674d871619

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
229B

MD5
a8bd1d56a00217ffe9c11da336aa68cf

SHA1
dcea7a7ffd1caeeddd731686add04a274b69d46c

SHA256
2d6a91ca29f0867aaa4bdd883c3d6809bff4cf4dbacc7cae521092a232488cd8

SHA512
576387b38c496ecfd198720d2768f06d9c4eda4472bb96883b39a720b0e19f6ed8ed7462d99ebc936c0caec0cd672e9e054b93f335d42b52bdae48b4430d5fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
641B

MD5
fadc17d42615e99a13f53c1663f62fb3

SHA1
9f96738ed760f86bdf3827736beab3ffa9990d73

SHA256
1a9b71a5ca8fe9ae5a85d9b22f4fd90e674e350990ed52f3381bd35638f83ccf

SHA512
0a98aedbd5bc2cf294c66505e97b893b3cc6fdf396c1cd9a8125c802052ebda308d5275f8361173126a548457c9d7447a961c2e4534d55954002c70f44ddcac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
641B

MD5
283a03cee641b9bb3a2ec4051291ef0d

SHA1
73535eeab1ed99658fbb161ddb09ba394f9d5544

SHA256
9dccd2156802ba7103c7057a54b5e89020b446105cdffe34aec5a657d5da34ac

SHA512
ec117260a549507afa0276cf4d74bbfeab3938ea0296554ce8cab570b1eb7c00d990bc121196c8f709926cf8d8b321ad7780cf4de1f87983a22a277abc548153

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
14KB

MD5
a156f1cfd3846a132848a3018e218b33

SHA1
37bc47a47370653ca724cffbad7ffc5cef7d8265

SHA256
c2341cd5f856b605c37d1c36cb53f34830d17e909431e452034778bb93e8b7b7

SHA512
e985c0d4e64f88a055f333562d4406c41682587ee6b0a4e3c8deed3919d647f0b4ef6b6d8e02b980fca6ac226be3112bf6dfc5eed36550f1d9c25823d5ae2bd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
27KB

MD5
c2434acca96b2e7533304376bf8c06c2

SHA1
563389b029574146469db6af3986332069e117d2

SHA256
374ae68baea42b8a625e7370253e73ea95236afefcf1dcac857f12fada06aef5

SHA512
228fc352aee1164ed946466a7e40a9f2c1659604140234f8b437515c5f4b1b2a157f5a4727477619921addc744d09e45f659704333dc9840779e662fa921424d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
14KB

MD5
0c2c591b24db1d896211278f5c23716f

SHA1
bfec4ab91d8a356f579f4a9e2d1690000912ec6b

SHA256
5f76c7302141139ccef95579a5bc66b662c093726b95184047898729effa19be

SHA512
b0c31da6865dc86d51c190c691d75f714aa6cf9c57a9c165c471dde694b7df6ec57c3d53e74d62944efc11422df896c5241406e12d1c32c3ba36a5423dbbe01e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
990B

MD5
462925089e3516f855e87624ae8a1961

SHA1
5eb87d74653197fcf9e430d14451f39c5e6997d6

SHA256
39a2f2ad0f241dc1807da65a7b325c7f158c6736073f835c959a3b5c36e5cabf

SHA512
192536315429f14c9a0241872ef7233b76e35f04d344a242659f23fe63b0d9c67e7aa1a3062e9371133a6b978287345c9aa861d61199352e9a811de9259d1a66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
990B

MD5
285f1d4a07b618a991192d7bf32080ce

SHA1
831fc835fc787f74de7e3e2d51367941fbf12baa

SHA256
b73aa0067ff5a92e1b81722152fabbde085011aeee9a088ef0be60ec0702ebf7

SHA512
2fae02c8848ea3452a2edc29527f9b423bbe72aa7b472dfe42cfae6b45bb70ead7d55c09d90a15315f070d2ec326a2faa8c34d3ebe68cece0a6be509b5ae132e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
990B

MD5
f4ee5d34f06155bc38ab63aa12529710

SHA1
071539239038121cf072cb7c5844f5e08c1c2f23

SHA256
7d4672305d75dfe2343b03be0a38e99df218c29ea8aac95e76d8d083f392a90b

SHA512
32ce778b3a754cd49552ce97a7cedd9bdd8754d194cabfeb40a4efd5e210e8cd838b933195eb0a46787b7670b36c40decc2beaa5a874f04438b455efb00ae782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
990B

MD5
e78ea447dbf6d334fe17c9bd4198b6ca

SHA1
267c6c83579bffe0635e3ad360ee2c3abe540648

SHA256
5dabe4f0fdee6d62051c3c8183881504c795faed84a8dfda86470a250eb7c144

SHA512
022e04fa4adcc581630d233a3070dc8c1627f026970911995985dc12f90a12a954b1bf0c5555a57bcbd9f78917404edba873ed80542a2f73ae0d973c65992c3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
990B

MD5
fd0f096dd03853fefaf7d0e71e168b5f

SHA1
d3de68f60f6aaaac1a0026f11916864c6ace4c5c

SHA256
6ef9c8900c4aa1128463c6d059070f8cbc76ea67e54c8ff47043b61edcfa81bc

SHA512
6717275204634474cb0feded84866658ab2255458bf9dbf77af0a2681513389564267bcd6d84701b5d9a0d86baee73e892cb14c2ec9d940fd706c7d71b6aeab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
990B

MD5
77b9a95c3494cd3b4186f02e95578365

SHA1
48180b6d22f5cf8d879620b031f79b8d5d0f4288

SHA256
e6a6d3481ec70726d97244c22e6cc8ad7c4899782b60cfe792882f9c3d4b8d13

SHA512
d7522462a8ecef2aaeeb540a612663a812431be03403bb5f894f968c1008b95bac68637c94f2ba383f75cc746d7ea0737aaa1510474db06bd4dd28bc8dc795e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
990B

MD5
b712e6b194a575504f5a3ad25dd61a30

SHA1
b46685b8a9bce56deb092b2be7bd521d1017f34c

SHA256
0d59a694fc25892584440aa3e195b709e89f4fcc0252c3777628a79627cb8e4c

SHA512
767cfe8c113c73e063b44f43b16eccbc3aa587bb39308074b06c79cbcf8c9fac7dda3451fd9329ce4244557737138bde3d199003ef72bbc3f73de25d0241ee72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IJ4Z29YW\www.youtube[1].xml

Filesize
13B

MD5
c1ddea3ef6bbef3e7060a1a9ad89e4c5

SHA1
35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

SHA256
b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

SHA512
6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab433A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar433B.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar441C.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response