80c19dec17f678eab17f9965b5c352e19a7ebb4959c05d1b0bff537779e7dfdc

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 03:06 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

74252c8c838bf0b312d0f0316f72d71c_JaffaCakes118.html
Size

118KB
MD5

74252c8c838bf0b312d0f0316f72d71c
SHA1

194d70216c67923de2ffe8f8ca3539c4ca88d6e4
SHA256

80c19dec17f678eab17f9965b5c352e19a7ebb4959c05d1b0bff537779e7dfdc
SHA512

0fe85839cf72362e30ce53e28d8b1d110eff01356eb16b9691229fcf7d1c298f51387a6ac66efe54cfd6942af5554a4cdbb9ef6eebe8ae590fa490fe038c6db1
SSDEEP

3072:ADehhpn7vB/6QavGU1Qk5a9VozALH4ZFAZPoZVUZdS8gxP1J07C:AEpn7vB/60kzX

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
40	sites.google.com
54	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
2492	msedge.exe
2492	msedge.exe
2500	identity_helper.exe
2500	identity_helper.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe
5288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 3224	2492	msedge.exe	82
PID 2492 wrote to memory of 3224	2492	msedge.exe	82
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1920	2492	msedge.exe	83
PID 2492 wrote to memory of 1532	2492	msedge.exe	84
PID 2492 wrote to memory of 1532	2492	msedge.exe	84
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85
PID 2492 wrote to memory of 688	2492	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\74252c8c838bf0b312d0f0316f72d71c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c04046f8,0x7ff8c0404708,0x7ff8c0404718
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,1619913468435150801,3459050213615557561,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4448

Network

DNS

232.168.11.51.in-addr.arpa

Remote address:

8.8.8.8:53

Request

232.168.11.51.in-addr.arpa

IN PTR

Response
DNS

www.blogger.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.blogger.com

IN A

Response

www.blogger.com

IN CNAME

blogger.l.google.com

blogger.l.google.com

IN A

142.250.178.9
DNS

dl.dropbox.com

msedge.exe

Remote address:

8.8.8.8:53

Request

dl.dropbox.com

IN A

Response

dl.dropbox.com

IN CNAME

edge-block-www-env.dropbox-dns.com

edge-block-www-env.dropbox-dns.com

IN A

162.125.64.15
DNS

halotemplates.s3.amazonaws.com

msedge.exe

Remote address:

8.8.8.8:53

Request

halotemplates.s3.amazonaws.com

IN A

Response

halotemplates.s3.amazonaws.com

IN CNAME

s3-ap-southeast-2-w.amazonaws.com

s3-ap-southeast-2-w.amazonaws.com

IN A

52.95.131.21

s3-ap-southeast-2-w.amazonaws.com

IN A

52.95.130.81

s3-ap-southeast-2-w.amazonaws.com

IN A

52.95.131.185

s3-ap-southeast-2-w.amazonaws.com

IN A

52.95.131.145

s3-ap-southeast-2-w.amazonaws.com

IN A

52.95.128.140

s3-ap-southeast-2-w.amazonaws.com

IN A

52.95.129.177

s3-ap-southeast-2-w.amazonaws.com

IN A

52.95.130.189

s3-ap-southeast-2-w.amazonaws.com

IN A

52.95.134.156
GET

https://www.blogger.com/static/v1/widgets/254310735-widget_css_bundle.css

msedge.exe

Remote address:

142.250.178.9:443

Request

GET /static/v1/widgets/254310735-widget_css_bundle.css HTTP/2.0
host: www.blogger.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: style
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.blogger.com/static/v1/widgets/211300122-widgets.js

msedge.exe

Remote address:

142.250.178.9:443

Request

GET /static/v1/widgets/211300122-widgets.js HTTP/2.0
host: www.blogger.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=7332739211150558424&zx=21a5e239-3a67-43ef-ad74-b33e22a26a0a

msedge.exe

Remote address:

142.250.178.9:443

Request

GET /dyn-css/authorization.css?targetBlogID=7332739211150558424&zx=21a5e239-3a67-43ef-ad74-b33e22a26a0a HTTP/2.0
host: www.blogger.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: style
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

http://dl.dropbox.com/u/16265358/downloadsgratis/jquery.flexislider.js

msedge.exe

Remote address:

162.125.64.15:80

Request

GET /u/16265358/downloadsgratis/jquery.flexislider.js HTTP/1.1
Host: dl.dropbox.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 301 Moved Permanently

location: https://dl.dropbox.com/u/16265358/downloadsgratis/jquery.flexislider.js
date: Sun, 26 May 2024 03:06:43 GMT
server: envoy
x-dropbox-request-id: aa58547bb2a146108379070348771f5e
content-length: 0
GET

http://dl.dropbox.com/u/16265358/downloadsgratis/jquery.js

msedge.exe

Remote address:

162.125.64.15:80

Request

GET /u/16265358/downloadsgratis/jquery.js HTTP/1.1
Host: dl.dropbox.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 301 Moved Permanently

location: https://dl.dropbox.com/u/16265358/downloadsgratis/jquery.js
date: Sun, 26 May 2024 03:06:43 GMT
server: envoy
x-dropbox-request-id: 13f152ea06fd4038ba015f71aae0a4cd
content-length: 0
GET

http://dl.dropbox.com/u/16265358/downloadsgratis/style.css

msedge.exe

Remote address:

162.125.64.15:80

Request

GET /u/16265358/downloadsgratis/style.css HTTP/1.1
Host: dl.dropbox.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 301 Moved Permanently

location: https://dl.dropbox.com/u/16265358/downloadsgratis/style.css
date: Sun, 26 May 2024 03:06:43 GMT
server: envoy
x-dropbox-request-id: 50e57a349a044ffd9bacb2829d6fc94b
content-length: 0
GET

http://halotemplates.s3.amazonaws.com/jquery-truncator/jquery.extractor.js

msedge.exe

Remote address:

52.95.131.21:80

Request

GET /jquery-truncator/jquery.extractor.js HTTP/1.1
Host: halotemplates.s3.amazonaws.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 403 Forbidden

x-amz-request-id: MXT2KBENDDB7E95Y
x-amz-id-2: clUHVBN+2YEod9UxjyFKVRI0dDaROQeeBVl0ERRTheqkX+pHeF9c2ggcPfEl1+zFcgabVcIZPW8=
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Sun, 26 May 2024 03:06:43 GMT
Server: AmazonS3
GET

http://halotemplates.s3.amazonaws.com/jquery-truncator/jquery-1.2.3.pack.js

msedge.exe

Remote address:

52.95.131.21:80

Request

GET /jquery-truncator/jquery-1.2.3.pack.js HTTP/1.1
Host: halotemplates.s3.amazonaws.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 403 Forbidden

x-amz-request-id: MXT5P08644CATJ2A
x-amz-id-2: kMG6qT1gWV2ayS8eOhPpq8EWybR++PUHk5sE3PcZvxZiqxtPLh3/YSFbjEskFbQgUTcsp5f/uoY=
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Sun, 26 May 2024 03:06:43 GMT
Server: AmazonS3
GET

https://dl.dropbox.com/u/16265358/downloadsgratis/style.css

msedge.exe

Remote address:

162.125.64.15:443

Request

GET /u/16265358/downloadsgratis/style.css HTTP/2.0
host: dl.dropbox.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: style
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 404

content-type: text/html
date: Sun, 26 May 2024 03:06:43 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
vary: Accept-Encoding
x-dropbox-response-origin: remote
x-dropbox-request-id: 1a4f3934a8ea4958896365abfd9231a6
GET

https://dl.dropbox.com/u/16265358/downloadsgratis/jquery.flexislider.js

msedge.exe

Remote address:

162.125.64.15:443

Request

GET /u/16265358/downloadsgratis/jquery.flexislider.js HTTP/2.0
host: dl.dropbox.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 404

content-type: text/html
date: Sun, 26 May 2024 03:06:43 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
vary: Accept-Encoding
x-dropbox-response-origin: remote
x-dropbox-request-id: e5e10188ba3a46b8bf213c053de371fa
GET

https://dl.dropbox.com/u/16265358/downloadsgratis/jquery.js

msedge.exe

Remote address:

162.125.64.15:443

Request

GET /u/16265358/downloadsgratis/jquery.js HTTP/2.0
host: dl.dropbox.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 404

content-type: text/html
date: Sun, 26 May 2024 03:06:43 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
vary: Accept-Encoding
x-dropbox-response-origin: remote
x-dropbox-request-id: 95e556c57c60443884c71e94bb4a2ee6
GET

https://dl.dropbox.com/u/16265358/downloadsgratis/jquery.flexislider.js

msedge.exe

Remote address:

162.125.64.15:443

Request

GET /u/16265358/downloadsgratis/jquery.flexislider.js HTTP/2.0
host: dl.dropbox.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 404

content-type: text/html
date: Sun, 26 May 2024 03:06:43 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
vary: Accept-Encoding
x-dropbox-response-origin: remote
x-dropbox-request-id: 210b218081f8416c83f6faa0a39dce20
GET

https://dl.dropbox.com/u/16265358/downloadsgratis/print.css

msedge.exe

Remote address:

162.125.64.15:443

Request

GET /u/16265358/downloadsgratis/print.css HTTP/2.0
host: dl.dropbox.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: text/css,*/*;q=0.1
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: style
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 404

content-type: text/html
date: Sun, 26 May 2024 03:06:43 GMT
server: envoy
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
vary: Accept-Encoding
x-dropbox-response-origin: remote
x-dropbox-request-id: 2a6f879ad058447da404087f07f2d65a
DNS

73.31.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

73.31.126.40.in-addr.arpa

IN PTR

Response
DNS

s7.addthis.com

msedge.exe

Remote address:

8.8.8.8:53

Request

s7.addthis.com

IN A

Response

s7.addthis.com

IN CNAME

s8.addthis.com

s8.addthis.com

IN CNAME

ds-s7.addthis.com.edgekey.net

ds-s7.addthis.com.edgekey.net

IN CNAME

e4016.a.akamaiedge.net

e4016.a.akamaiedge.net

IN A

104.68.81.91
GET

http://s7.addthis.com/js/250/addthis_widget.js

msedge.exe

Remote address:

104.68.81.91:80

Request

GET /js/250/addthis_widget.js HTTP/1.1
Host: s7.addthis.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 308 Permanent Redirect

Server: nginx/1.15.8
Content-Type: text/html
Content-Length: 171
Location: https://s7.addthis.com/js/250/addthis_widget.js
Date: Sun, 26 May 2024 03:06:44 GMT
Connection: keep-alive
X-Distribution: 99
X-Host: s7.addthis.com
DNS

www.akaluma.me

msedge.exe

Remote address:

8.8.8.8:53

Request

www.akaluma.me

IN A

Response
DNS

goo.gl

msedge.exe

Remote address:

8.8.8.8:53

Request

goo.gl

IN A

Response

goo.gl

IN A

142.250.187.238
GET

https://s7.addthis.com/js/250/addthis_widget.js

msedge.exe

Remote address:

104.68.81.91:443

Request

GET /js/250/addthis_widget.js HTTP/2.0
host: s7.addthis.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: text/plain
content-length: 16
server: Oracle API Gateway
strict-transport-security: max-age=31536000
opc-request-id: /29FDDA545D823881F0B41C2B1588E7C3/8E7B0AD92344CA094B42C94977C1BDCD
x-content-type-options: nosniff
x-frame-options: sameorigin
x-xss-protection: 1; mode=block
date: Sun, 26 May 2024 03:06:44 GMT
x-distribution: 99
x-host: s7.addthis.com
DNS

ajax.googleapis.com

msedge.exe

Remote address:

8.8.8.8:53

Request

ajax.googleapis.com

IN A

Response

ajax.googleapis.com

IN A

142.250.187.234
DNS

4.bp.blogspot.com

msedge.exe

Remote address:

8.8.8.8:53

Request

4.bp.blogspot.com

IN A

Response

4.bp.blogspot.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.180.1
DNS

apis.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

apis.google.com

IN A

Response

apis.google.com

IN CNAME

plus.l.google.com

plus.l.google.com

IN A

142.250.200.14
GET

http://goo.gl/ymK7Q

msedge.exe

Remote address:

142.250.187.238:80

Request

GET /ymK7Q HTTP/1.1
Host: goo.gl
Connection: keep-alive
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 301 Moved Permanently

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Sun, 26 May 2024 03:06:44 GMT
Location: https://goo.gl/ymK7Q
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
DNS

1.bp.blogspot.com

msedge.exe

Remote address:

8.8.8.8:53

Request

1.bp.blogspot.com

IN A

Response

1.bp.blogspot.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.180.1
DNS

2.bp.blogspot.com

msedge.exe

Remote address:

8.8.8.8:53

Request

2.bp.blogspot.com

IN A

Response

2.bp.blogspot.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.180.1
DNS

sites.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

sites.google.com

IN A

Response

sites.google.com

IN A

142.250.179.238
DNS

resources.blogblog.com

msedge.exe

Remote address:

8.8.8.8:53

Request

resources.blogblog.com

IN A

Response

resources.blogblog.com

IN CNAME

blogger.l.google.com

blogger.l.google.com

IN A

142.250.178.9
DNS

3.bp.blogspot.com

msedge.exe

Remote address:

8.8.8.8:53

Request

3.bp.blogspot.com

IN A

Response

3.bp.blogspot.com

IN CNAME

photos-ugc.l.googleusercontent.com

photos-ugc.l.googleusercontent.com

IN A

142.250.180.1
DNS

i.imgur.com

msedge.exe

Remote address:

8.8.8.8:53

Request

i.imgur.com

IN A

Response

i.imgur.com

IN CNAME

ipv4.imgur.map.fastly.net

ipv4.imgur.map.fastly.net

IN A

199.232.192.193

ipv4.imgur.map.fastly.net

IN A

199.232.196.193
GET

https://apis.google.com/js/plusone.js

msedge.exe

Remote address:

142.250.200.14:443

Request

GET /js/plusone.js HTTP/2.0
host: apis.google.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

http://1.bp.blogspot.com/-g_mK6_t-LVk/VCgy8uCOp5I/AAAAAAAAAA4/6CK-mon1hK8/s1600/HEEADER.jpg

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-g_mK6_t-LVk/VCgy8uCOp5I/AAAAAAAAAA4/6CK-mon1hK8/s1600/HEEADER.jpg HTTP/1.1
Host: 1.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/jpeg
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
ETag: "vf"
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="HEEADER.jpg"
X-Content-Type-Options: nosniff
Date: Sun, 26 May 2024 03:06:44 GMT
Server: fife
Content-Length: 327469
X-XSS-Protection: 0
GET

https://resources.blogblog.com/img/icon18_wrench_allbkg.png

msedge.exe

Remote address:

142.250.178.9:443

Request

GET /img/icon18_wrench_allbkg.png HTTP/2.0
host: resources.blogblog.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

http://i.imgur.com/5efYNqX.jpg

msedge.exe

Remote address:

199.232.192.193:80

Request

GET /5efYNqX.jpg HTTP/1.1
Host: i.imgur.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 301 Moved Permanently

Connection: close
Content-Length: 0
Retry-After: 0
Location: https://i.imgur.com/5efYNqX.jpg
Accept-Ranges: bytes
Date: Sun, 26 May 2024 03:06:44 GMT
X-Served-By: cache-lcy-eglc8600048-LCY
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1716692804.266016,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
GET

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js

msedge.exe

Remote address:

142.250.187.234:80

Request

GET /ajax/libs/jquery/1.3.2/jquery.min.js HTTP/1.1
Host: ajax.googleapis.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Encoding: gzip
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="hosted-libraries-pushers"
Report-To: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
Timing-Allow-Origin: *
Content-Length: 19926
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sun, 26 May 2024 02:46:08 GMT
Expires: Mon, 26 May 2025 02:46:08 GMT
Cache-Control: public, max-age=31536000, stale-while-revalidate=2592000
Age: 1236
Last-Modified: Tue, 03 Mar 2020 19:15:00 GMT
Content-Type: text/javascript; charset=UTF-8
Vary: Accept-Encoding
GET

http://2.bp.blogspot.com/-hr-3ETj7Eaw/T9fRTLY3EsI/AAAAAAAAASw/JpAEoiVzMrg/s1600/C%C3%BA_Sidebar.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-hr-3ETj7Eaw/T9fRTLY3EsI/AAAAAAAAASw/JpAEoiVzMrg/s1600/C%C3%BA_Sidebar.png HTTP/1.1
Host: 2.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="C__Sidebar.png";filename*=UTF-8''C%C3%BA_Sidebar.png
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 8761
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v12c"
Content-Type: image/png
Vary: Origin
Age: 0
GET

http://2.bp.blogspot.com/-aI5gRIBuue4/Upe8IeuipqI/AAAAAAAAABw/tG-pMVtEshI/s1600/desenhos-de-natal-para-colorir-e-imprimir-03.gif

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-aI5gRIBuue4/Upe8IeuipqI/AAAAAAAAABw/tG-pMVtEshI/s1600/desenhos-de-natal-para-colorir-e-imprimir-03.gif HTTP/1.1
Host: 2.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="desenhos-de-natal-para-colorir-e-imprimir-03.gif"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 55434
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v1d"
Content-Type: image/gif
Vary: Origin
Age: 0
GET

http://2.bp.blogspot.com/-JEEAJKd_1WU/U5fsiWlXW0I/AAAAAAAAAE0/r7JntVugRBE/s1600/Rodape.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-JEEAJKd_1WU/U5fsiWlXW0I/AAAAAAAAAE0/r7JntVugRBE/s1600/Rodape.png HTTP/1.1
Host: 2.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/png
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
ETag: "v4e"
Expires: Mon, 27 May 2024 03:06:45 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="Rodape.png"
X-Content-Type-Options: nosniff
Date: Sun, 26 May 2024 03:06:45 GMT
Server: fife
Content-Length: 1149035
X-XSS-Protection: 0
GET

http://2.bp.blogspot.com/-_NL7K8iiANQ/T9kNSlxEjmI/AAAAAAAAAUA/4-U9zTCnLik/s1600/Leia+Mais.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-_NL7K8iiANQ/T9kNSlxEjmI/AAAAAAAAAUA/4-U9zTCnLik/s1600/Leia+Mais.png HTTP/1.1
Host: 2.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="Leia Mais.png"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 22853
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v140"
Content-Type: image/png
Vary: Origin
Age: 0
GET

http://2.bp.blogspot.com/-tXI3MX3YWnE/T9fWYUsVuMI/AAAAAAAAATo/7Twn-b5bkc8/s1600/Inicio.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-tXI3MX3YWnE/T9fWYUsVuMI/AAAAAAAAATo/7Twn-b5bkc8/s1600/Inicio.png HTTP/1.1
Host: 2.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="Inicio.png"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 15861
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
Age: 0
ETag: "v13a"
Content-Type: image/png
Vary: Origin
GET

http://2.bp.blogspot.com/-c5qMpwQjfA0/T9fQn5eep1I/AAAAAAAAASY/_5PIh7Df_X4/s1600/C%C3%BA-Post.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-c5qMpwQjfA0/T9fQn5eep1I/AAAAAAAAASY/_5PIh7Df_X4/s1600/C%C3%BA-Post.png HTTP/1.1
Host: 2.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/png
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
ETag: "v126"
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="C_-Post.png";filename*=UTF-8''C%C3%BA-Post.png
X-Content-Type-Options: nosniff
Date: Sun, 26 May 2024 03:06:44 GMT
Server: fife
Content-Length: 81540
X-XSS-Protection: 0
GET

http://2.bp.blogspot.com/-EHe6xsLnYmU/U2TlBxv1nnI/AAAAAAAACfo/D-96xA2HR4Q/s300/cd70urj9cakqq0vzes8w.jpg

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-EHe6xsLnYmU/U2TlBxv1nnI/AAAAAAAACfo/D-96xA2HR4Q/s300/cd70urj9cakqq0vzes8w.jpg HTTP/1.1
Host: 2.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="cd70urj9cakqq0vzes8w.jpg"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 25553
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v9fb"
Content-Type: image/jpeg
Vary: Origin
Age: 0
GET

https://sites.google.com/site/superdicasblogspot/pagenavi2.js

msedge.exe

Remote address:

142.250.179.238:443

Request

GET /site/superdicasblogspot/pagenavi2.js HTTP/2.0
host: sites.google.com
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: script
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

http://4.bp.blogspot.com/-7RfrtSkLvfI/T9fUEK9EgVI/AAAAAAAAATI/qyKUOYkpkas/s1600/buscar.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-7RfrtSkLvfI/T9fUEK9EgVI/AAAAAAAAATI/qyKUOYkpkas/s1600/buscar.png HTTP/1.1
Host: 4.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="buscar.png"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 7919
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
Age: 0
ETag: "v132"
Content-Type: image/png
Vary: Origin
GET

http://4.bp.blogspot.com/-hBVR2SqENA8/T9fQYnkaRXI/AAAAAAAAASI/PUALuhnBwyY/s1600/Meio-Post.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-hBVR2SqENA8/T9fQYnkaRXI/AAAAAAAAASI/PUALuhnBwyY/s1600/Meio-Post.png HTTP/1.1
Host: 4.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/png
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
ETag: "v122"
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="Meio-Post.png"
X-Content-Type-Options: nosniff
Date: Sun, 26 May 2024 03:06:44 GMT
Server: fife
Content-Length: 2937
X-XSS-Protection: 0
GET

http://4.bp.blogspot.com/-uNfZJ1N3FdE/T9fQO0MKblI/AAAAAAAAASA/HOIyhTA8UN0/s1600/Topo-Post.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-uNfZJ1N3FdE/T9fQO0MKblI/AAAAAAAAASA/HOIyhTA8UN0/s1600/Topo-Post.png HTTP/1.1
Host: 4.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Content-Type: image/png
Vary: Origin
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
ETag: "v120"
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
Content-Disposition: inline;filename="Topo-Post.png"
X-Content-Type-Options: nosniff
Date: Sun, 26 May 2024 03:06:44 GMT
Server: fife
Content-Length: 82156
X-XSS-Protection: 0
GET

http://3.bp.blogspot.com/-Fb8PNf6bqLE/VC6XyfoW53I/AAAAAAAAIAU/zt2LQ7VlLgo/s300/CAPA.jpg

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-Fb8PNf6bqLE/VC6XyfoW53I/AAAAAAAAIAU/zt2LQ7VlLgo/s300/CAPA.jpg HTTP/1.1
Host: 3.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="CAPA.jpg"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 35534
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v2006"
Content-Type: image/jpeg
Vary: Origin
Age: 0
GET

http://i.imgur.com/M9P0E3q.jpg

msedge.exe

Remote address:

199.232.192.193:80

Request

GET /M9P0E3q.jpg HTTP/1.1
Host: i.imgur.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 301 Moved Permanently

Connection: close
Content-Length: 0
Retry-After: 0
Location: https://i.imgur.com/M9P0E3q.jpg
Accept-Ranges: bytes
Date: Sun, 26 May 2024 03:06:44 GMT
X-Served-By: cache-lcy-eglc8600099-LCY
X-Cache: HIT
X-Cache-Hits: 0
X-Timer: S1716692804.296028,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
GET

https://i.imgur.com/5efYNqX.jpg

msedge.exe

Remote address:

199.232.192.193:443

Request

GET /5efYNqX.jpg HTTP/2.0
host: i.imgur.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/jpeg
last-modified: Mon, 29 Sep 2014 21:47:12 GMT
etag: "c549d07b64f982a481403b95e838d4f8"
x-amz-cf-pop: IAD12-P2
x-amz-cf-id: lOnRA_dCc4GQcw5y-vbYLTk6kfkSR8UIV8glwU2mzsqUwJ-w4nSKbQ==
cache-control: public, max-age=31536000
accept-ranges: bytes
age: 211362
date: Sun, 26 May 2024 03:06:44 GMT
x-served-by: cache-iad-kcgs7200056-IAD, cache-lcy-eglc8600075-LCY
x-cache: Miss from cloudfront, HIT, MISS
x-cache-hits: 1, 0
x-timer: S1716692804.445928,VS0,VE78
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
server: cat factory 1.0
x-content-type-options: nosniff
content-length: 90222
GET

https://i.imgur.com/M9P0E3q.jpg

msedge.exe

Remote address:

199.232.192.193:443

Request

GET /M9P0E3q.jpg HTTP/2.0
host: i.imgur.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/jpeg
last-modified: Mon, 29 Sep 2014 12:55:59 GMT
etag: "297114610323bf5a2f74a36071b502e6"
x-amz-cf-pop: IAD89-P1
x-amz-cf-id: gPxzHKVPPDmRnPRleu4623-CMZvyB7FUvnb2enR7zzMcbfohTw6YtQ==
cache-control: public, max-age=31536000
accept-ranges: bytes
age: 0
date: Sun, 26 May 2024 03:06:44 GMT
x-served-by: cache-iad-kcgs7200128-IAD, cache-lcy-eglc8600075-LCY
x-cache: Miss from cloudfront, MISS, MISS
x-cache-hits: 0, 0
x-timer: S1716692804.445896,VS0,VE131
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
server: cat factory 1.0
x-content-type-options: nosniff
content-length: 29242
GET

https://i.imgur.com/vp0rh.png

msedge.exe

Remote address:

199.232.192.193:443

Request

GET /vp0rh.png HTTP/2.0
host: i.imgur.com
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: cross-site
sec-fetch-mode: no-cors
sec-fetch-dest: image
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

content-type: image/png
last-modified: Tue, 20 Dec 2011 12:44:28 GMT
etag: "f881b7602b0059e64656283ca0dec398"
x-amz-cf-pop: IAD89-P1
x-amz-cf-id: rTr2YKMUdFT8DYUCI1mPcKyOSAbnbzFsY2OJUiZF3xOFovtUZguOqQ==
cache-control: public, max-age=31536000
accept-ranges: bytes
age: 375953
date: Sun, 26 May 2024 03:07:05 GMT
x-served-by: cache-iad-kcgs7200167-IAD, cache-lcy-eglc8600075-LCY
x-cache: Miss from cloudfront, HIT, HIT
x-cache-hits: 54, 0
x-timer: S1716692826.905919,VS0,VE78
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
server: cat factory 1.0
x-content-type-options: nosniff
content-length: 27437
GET

https://goo.gl/ymK7Q

msedge.exe

Remote address:

142.250.187.238:443

Request

GET /ymK7Q HTTP/2.0
host: goo.gl
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

http://2.bp.blogspot.com/-BucR4RD8khs/VCdYqmpNMvI/AAAAAAAASMU/J60zfMa02lo/s320/poster.jpg

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-BucR4RD8khs/VCdYqmpNMvI/AAAAAAAASMU/J60zfMa02lo/s320/poster.jpg HTTP/1.1
Host: 2.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="poster.jpg"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 27750
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v4a76"
Content-Type: image/jpeg
Vary: Origin
Age: 0
GET

http://3.bp.blogspot.com/-D--Nx7RNd74/VCMbEnCHKxI/AAAAAAAAVvI/EAAQUoEUb1k/s1600/ffgfgfg.jpg

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-D--Nx7RNd74/VCMbEnCHKxI/AAAAAAAAVvI/EAAQUoEUb1k/s1600/ffgfgfg.jpg HTTP/1.1
Host: 3.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="ffgfgfg.jpg"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 24388
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v56f3"
Content-Type: image/jpeg
Vary: Origin
Age: 0
GET

http://3.bp.blogspot.com/-lw_xzVZ04nE/VB0znFsFUhI/AAAAAAAAU7s/lG9cFTnAvBw/s1600/licoesdavidaok.jpg

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-lw_xzVZ04nE/VB0znFsFUhI/AAAAAAAAU7s/lG9cFTnAvBw/s1600/licoesdavidaok.jpg HTTP/1.1
Host: 3.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="licoesdavidaok.jpg"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 74397
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v53bd"
Content-Type: image/jpeg
Vary: Origin
Age: 0
GET

http://3.bp.blogspot.com/-Qv51zFvgr3I/T9fRGsgbaDI/AAAAAAAAASg/BVxxJrIeiHw/s1600/Topo_Sidebar.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-Qv51zFvgr3I/T9fRGsgbaDI/AAAAAAAAASg/BVxxJrIeiHw/s1600/Topo_Sidebar.png HTTP/1.1
Host: 3.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="Topo_Sidebar.png"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 25745
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:45 GMT
Expires: Mon, 27 May 2024 03:06:45 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v128"
Content-Type: image/png
Vary: Origin
Age: 0
GET

http://3.bp.blogspot.com/-Ay0YHuSsj0o/VCBmAVBOZoI/AAAAAAAASCs/712LJDRKzyg/s1600/capa1.jpg

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-Ay0YHuSsj0o/VCBmAVBOZoI/AAAAAAAASCs/712LJDRKzyg/s1600/capa1.jpg HTTP/1.1
Host: 3.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="capa1.jpg"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 562330
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v7af6"
Content-Type: image/jpeg
Vary: Origin
Age: 0
GET

http://3.bp.blogspot.com/-9aAKBlbCtUI/VCCLJIt8B9I/AAAAAAAAU84/Yzn9VKwmTdw/s1600/o%2Bamor%2Bmora%2Bao%2Blado2.jpg

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-9aAKBlbCtUI/VCCLJIt8B9I/AAAAAAAAU84/Yzn9VKwmTdw/s1600/o%2Bamor%2Bmora%2Bao%2Blado2.jpg HTTP/1.1
Host: 3.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="o amor mora ao lado2.jpg"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 46188
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v53cf"
Content-Type: image/jpeg
Vary: Origin
Age: 0
GET

http://1.bp.blogspot.com/-REl-EW3L8gE/T9fWZuORCaI/AAAAAAAAATw/4MOrP-bcBZ0/s1600/Proximo.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-REl-EW3L8gE/T9fWZuORCaI/AAAAAAAAATw/4MOrP-bcBZ0/s1600/Proximo.png HTTP/1.1
Host: 1.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="Proximo.png"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 17520
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v13c"
Content-Type: image/png
Vary: Origin
Age: 0
GET

http://1.bp.blogspot.com/-riaSqytpoy0/T9fRNcaLEqI/AAAAAAAAASo/PqYpjnGmebc/s1600/Meio_Sidebar.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-riaSqytpoy0/T9fRNcaLEqI/AAAAAAAAASo/PqYpjnGmebc/s1600/Meio_Sidebar.png HTTP/1.1
Host: 1.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="Meio_Sidebar.png"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 2906
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "v12a"
Content-Type: image/png
Vary: Origin
Age: 0
DNS

counter6.statcounterfree.com

msedge.exe

Remote address:

8.8.8.8:53

Request

counter6.statcounterfree.com

IN A

Response

counter6.statcounterfree.com

IN A

37.187.129.45
GET

http://counter6.statcounterfree.com/private/webcontadores.php?c=958dece031670ca13c7b437226a0380d

msedge.exe

Remote address:

37.187.129.45:80

Request

GET /private/webcontadores.php?c=958dece031670ca13c7b437226a0380d HTTP/1.1
Host: counter6.statcounterfree.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Date: Sun, 26 May 2024 03:06:44 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
X-Powered-By: PHP/5.4.16
Connection: close
Transfer-Encoding: chunked
Content-Type: image/png
GET

http://1.bp.blogspot.com/-jtSfWxFOVAA/T9Jy88d8HwI/AAAAAAAAAP4/UPXWRvFTZF0/s1600/jfiwm0.png

msedge.exe

Remote address:

142.250.180.1:80

Request

GET /-jtSfWxFOVAA/T9Jy88d8HwI/AAAAAAAAAP4/UPXWRvFTZF0/s1600/jfiwm0.png HTTP/1.1
Host: 1.bp.blogspot.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length
Content-Disposition: inline;filename="jfiwm0.png"
X-Content-Type-Options: nosniff
Server: fife
Content-Length: 2889
X-XSS-Protection: 0
Date: Sun, 26 May 2024 03:06:44 GMT
Expires: Mon, 27 May 2024 03:06:44 GMT
Cache-Control: public, max-age=86400, no-transform
ETag: "vfe"
Content-Type: image/png
Vary: Origin
Age: 0
DNS

www.facebook.com

Remote address:

8.8.8.8:53

Request

www.facebook.com

IN A

Response

www.facebook.com

IN CNAME

star-mini.c10r.facebook.com

star-mini.c10r.facebook.com

IN A

163.70.151.35
DNS

9.178.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

9.178.250.142.in-addr.arpa

IN PTR

Response

9.178.250.142.in-addr.arpa

IN PTR

lhr48s27-in-f91e100net
DNS

15.64.125.162.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.64.125.162.in-addr.arpa

IN PTR

Response
DNS

21.131.95.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

21.131.95.52.in-addr.arpa

IN PTR

Response

21.131.95.52.in-addr.arpa

IN PTR

s3-ap-southeast-2-w amazonawscom
DNS

91.81.68.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

91.81.68.104.in-addr.arpa

IN PTR

Response

91.81.68.104.in-addr.arpa

IN PTR

a104-68-81-91deploystaticakamaitechnologiescom
DNS

238.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.187.250.142.in-addr.arpa

IN PTR

Response

238.187.250.142.in-addr.arpa

IN PTR

lhr25s34-in-f141e100net
DNS

14.200.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.200.250.142.in-addr.arpa

IN PTR

Response

14.200.250.142.in-addr.arpa

IN PTR

lhr48s29-in-f141e100net
DNS

1.180.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.180.250.142.in-addr.arpa

IN PTR

Response

1.180.250.142.in-addr.arpa

IN PTR

lhr25s32-in-f11e100net
DNS

193.192.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

193.192.232.199.in-addr.arpa

IN PTR

Response
DNS

45.129.187.37.in-addr.arpa

Remote address:

8.8.8.8:53

Request

45.129.187.37.in-addr.arpa

IN PTR

Response

45.129.187.37.in-addr.arpa

IN PTR

ns316269 ip-37-187-129eu
DNS

238.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.179.250.142.in-addr.arpa

IN PTR

Response

238.179.250.142.in-addr.arpa

IN PTR

lhr25s31-in-f141e100net
DNS

234.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

234.187.250.142.in-addr.arpa

IN PTR

Response

234.187.250.142.in-addr.arpa

IN PTR

lhr25s34-in-f101e100net
DNS

accounts.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

accounts.google.com

IN A

Response

accounts.google.com

IN A

74.125.206.84
GET

https://accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D7332739211150558424%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByMwMDAwMDAiByMwMDAwMDAqByNGRkZGRkYyByMwMDAwMDA6ByMwMDAwMDBCByMwMDAwMDBKByMwMDAwMDBSByNGRkZGRkZaC3RyYW5zcGFyZW50%26pageSize%3D21%26origin%3Dhttp://viciadosemfilmesgratis.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.JisoxTPHVRs.O/am%253DAAAC/d%253D1/rs%253DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D7332739211150558424%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByMwMDAwMDAiByMwMDAwMDAqByNGRkZGRkYyByMwMDAwMDA6ByMwMDAwMDBCByMwMDAwMDBKByMwMDAwMDBSByNGRkZGRkZaC3RyYW5zcGFyZW50%26pageSize%3D21%26origin%3Dhttp://viciadosemfilmesgratis.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.JisoxTPHVRs.O/am%253DAAAC/d%253D1/rs%253DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/m%253D__features__%26bpli%3D1&go=true

msedge.exe

Remote address:

74.125.206.84:443

Request

GET /ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D7332739211150558424%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByMwMDAwMDAiByMwMDAwMDAqByNGRkZGRkYyByMwMDAwMDA6ByMwMDAwMDBCByMwMDAwMDBKByMwMDAwMDBSByNGRkZGRkZaC3RyYW5zcGFyZW50%26pageSize%3D21%26origin%3Dhttp://viciadosemfilmesgratis.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.JisoxTPHVRs.O/am%253DAAAC/d%253D1/rs%253DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D7332739211150558424%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByMwMDAwMDAiByMwMDAwMDAqByNGRkZGRkYyByMwMDAwMDA6ByMwMDAwMDBCByMwMDAwMDBKByMwMDAwMDBSByNGRkZGRkZaC3RyYW5zcGFyZW50%26pageSize%3D21%26origin%3Dhttp://viciadosemfilmesgratis.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.JisoxTPHVRs.O/am%253DAAAC/d%253D1/rs%253DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/m%253D__features__%26bpli%3D1&go=true HTTP/2.0
host: accounts.google.com
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

84.206.125.74.in-addr.arpa

Remote address:

8.8.8.8:53

Request

84.206.125.74.in-addr.arpa

IN PTR

Response

84.206.125.74.in-addr.arpa

IN PTR

wk-in-f841e100net
DNS

www.facebook.com

Remote address:

8.8.8.8:53

Request

www.facebook.com

IN A

Response

www.facebook.com

IN CNAME

star-mini.c10r.facebook.com

star-mini.c10r.facebook.com

IN A

157.240.221.35
GET

https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

Remote address:

23.62.61.97:443

Request

GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1107
date: Sun, 26 May 2024 03:06:49 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.5d3d3e17.1716692809.de95dec
DNS

97.61.62.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.61.62.23.in-addr.arpa

IN PTR

Response

97.61.62.23.in-addr.arpa

IN PTR

a23-62-61-97deploystaticakamaitechnologiescom
DNS

26.35.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

26.35.223.20.in-addr.arpa

IN PTR

Response
DNS

97.17.167.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.17.167.52.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

19.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.229.111.52.in-addr.arpa

IN PTR

Response
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
DNS

57.169.31.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.169.31.20.in-addr.arpa

IN PTR

Response
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 415458
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EEE1A5DFB1494C31A46A2F330A7E49D9 Ref B: LON04EDGE0811 Ref C: 2024-05-26T03:08:26Z
date: Sun, 26 May 2024 03:08:26 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 430689
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 93CB7B97EE7E43A5BEFF94166E931D83 Ref B: LON04EDGE0811 Ref C: 2024-05-26T03:08:26Z
date: Sun, 26 May 2024 03:08:26 GMT

142.250.178.9:443

https://www.blogger.com/dyn-css/authorization.css?targetBlogID=7332739211150558424&zx=21a5e239-3a67-43ef-ad74-b33e22a26a0a

tls, http2

msedge.exe

3.8kB
70.7kB
52
67

HTTP Request

GET https://www.blogger.com/static/v1/widgets/254310735-widget_css_bundle.css

HTTP Request

GET https://www.blogger.com/static/v1/widgets/211300122-widgets.js

HTTP Request

GET https://www.blogger.com/dyn-css/authorization.css?targetBlogID=7332739211150558424&zx=21a5e239-3a67-43ef-ad74-b33e22a26a0a
162.125.64.15:80

http://dl.dropbox.com/u/16265358/downloadsgratis/jquery.flexislider.js

http

msedge.exe

665 B
508 B
7
6

HTTP Request

GET http://dl.dropbox.com/u/16265358/downloadsgratis/jquery.flexislider.js

HTTP Response

301
162.125.64.15:80

http://dl.dropbox.com/u/16265358/downloadsgratis/jquery.js

http

msedge.exe

653 B
496 B
7
6

HTTP Request

GET http://dl.dropbox.com/u/16265358/downloadsgratis/jquery.js

HTTP Response

301
162.125.64.15:80

http://dl.dropbox.com/u/16265358/downloadsgratis/style.css

http

msedge.exe

668 B
496 B
7
6

HTTP Request

GET http://dl.dropbox.com/u/16265358/downloadsgratis/style.css

HTTP Response

301
52.95.131.21:80

http://halotemplates.s3.amazonaws.com/jquery-truncator/jquery.extractor.js

http

msedge.exe

773 B
1.7kB
9
9

HTTP Request

GET http://halotemplates.s3.amazonaws.com/jquery-truncator/jquery.extractor.js

HTTP Response

403
52.95.131.21:80

http://halotemplates.s3.amazonaws.com/jquery-truncator/jquery-1.2.3.pack.js

http

msedge.exe

774 B
1.7kB
9
9

HTTP Request

GET http://halotemplates.s3.amazonaws.com/jquery-truncator/jquery-1.2.3.pack.js

HTTP Response

403
162.125.64.15:443

https://dl.dropbox.com/u/16265358/downloadsgratis/print.css

tls, http2

msedge.exe

2.2kB
8.9kB
20
20

HTTP Request

GET https://dl.dropbox.com/u/16265358/downloadsgratis/style.css

HTTP Request

GET https://dl.dropbox.com/u/16265358/downloadsgratis/jquery.flexislider.js

HTTP Request

GET https://dl.dropbox.com/u/16265358/downloadsgratis/jquery.js

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Request

GET https://dl.dropbox.com/u/16265358/downloadsgratis/jquery.flexislider.js

HTTP Response

404

HTTP Request

GET https://dl.dropbox.com/u/16265358/downloadsgratis/print.css

HTTP Response

404
162.125.64.15:443

dl.dropbox.com

tls

msedge.exe

989 B
5.0kB
9
8
162.125.64.15:443

dl.dropbox.com

tls

msedge.exe

989 B
5.0kB
9
8
52.95.131.21:80

halotemplates.s3.amazonaws.com

msedge.exe

282 B
212 B
6
5
104.68.81.91:80

http://s7.addthis.com/js/250/addthis_widget.js

http

msedge.exe

641 B
726 B
7
6

HTTP Request

GET http://s7.addthis.com/js/250/addthis_widget.js

HTTP Response

308
104.68.81.91:443

https://s7.addthis.com/js/250/addthis_widget.js

tls, http2

msedge.exe

2.7kB
6.8kB
17
20

HTTP Request

GET https://s7.addthis.com/js/250/addthis_widget.js

HTTP Response

200
142.250.187.238:80

http://goo.gl/ymK7Q

http

msedge.exe

765 B
661 B
7
6

HTTP Request

GET http://goo.gl/ymK7Q

HTTP Response

301
142.250.200.14:443

https://apis.google.com/js/plusone.js

tls, http2

msedge.exe

2.5kB
29.4kB
32
31

HTTP Request

GET https://apis.google.com/js/plusone.js
142.250.180.1:80

http://1.bp.blogspot.com/-g_mK6_t-LVk/VCgy8uCOp5I/AAAAAAAAAA4/6CK-mon1hK8/s1600/HEEADER.jpg

http

msedge.exe

6.3kB
337.8kB
127
247

HTTP Request

GET http://1.bp.blogspot.com/-g_mK6_t-LVk/VCgy8uCOp5I/AAAAAAAAAA4/6CK-mon1hK8/s1600/HEEADER.jpg

HTTP Response

200
142.250.178.9:443

https://resources.blogblog.com/img/icon18_wrench_allbkg.png

tls, http2

msedge.exe

1.8kB
7.2kB
15
16

HTTP Request

GET https://resources.blogblog.com/img/icon18_wrench_allbkg.png
199.232.192.193:80

http://i.imgur.com/5efYNqX.jpg

http

msedge.exe

583 B
651 B
5
5

HTTP Request

GET http://i.imgur.com/5efYNqX.jpg

HTTP Response

301
142.250.187.234:80

http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js

http

msedge.exe

980 B
21.7kB
14
21

HTTP Request

GET http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js

HTTP Response

200
142.250.180.1:80

http://2.bp.blogspot.com/-hr-3ETj7Eaw/T9fRTLY3EsI/AAAAAAAAASw/JpAEoiVzMrg/s1600/C%C3%BA_Sidebar.png

http

msedge.exe

882 B
9.8kB
10
12

HTTP Request

GET http://2.bp.blogspot.com/-hr-3ETj7Eaw/T9fRTLY3EsI/AAAAAAAAASw/JpAEoiVzMrg/s1600/C%C3%BA_Sidebar.png

HTTP Response

200
142.250.180.1:80

http://2.bp.blogspot.com/-JEEAJKd_1WU/U5fsiWlXW0I/AAAAAAAAAE0/r7JntVugRBE/s1600/Rodape.png

http

msedge.exe

22.8kB
1.2MB
475
928

HTTP Request

GET http://2.bp.blogspot.com/-aI5gRIBuue4/Upe8IeuipqI/AAAAAAAAABw/tG-pMVtEshI/s1600/desenhos-de-natal-para-colorir-e-imprimir-03.gif

HTTP Response

200

HTTP Request

GET http://2.bp.blogspot.com/-JEEAJKd_1WU/U5fsiWlXW0I/AAAAAAAAAE0/r7JntVugRBE/s1600/Rodape.png

HTTP Response

200
142.250.180.1:80

http://2.bp.blogspot.com/-c5qMpwQjfA0/T9fQn5eep1I/AAAAAAAAASY/_5PIh7Df_X4/s1600/C%C3%BA-Post.png

http

msedge.exe

3.8kB
125.7kB
56
99

HTTP Request

GET http://2.bp.blogspot.com/-_NL7K8iiANQ/T9kNSlxEjmI/AAAAAAAAAUA/4-U9zTCnLik/s1600/Leia+Mais.png

HTTP Response

200

HTTP Request

GET http://2.bp.blogspot.com/-tXI3MX3YWnE/T9fWYUsVuMI/AAAAAAAAATo/7Twn-b5bkc8/s1600/Inicio.png

HTTP Response

200

HTTP Request

GET http://2.bp.blogspot.com/-c5qMpwQjfA0/T9fQn5eep1I/AAAAAAAAASY/_5PIh7Df_X4/s1600/C%C3%BA-Post.png

HTTP Response

200
142.250.180.1:80

http://2.bp.blogspot.com/-EHe6xsLnYmU/U2TlBxv1nnI/AAAAAAAACfo/D-96xA2HR4Q/s300/cd70urj9cakqq0vzes8w.jpg

http

msedge.exe

1.2kB
27.0kB
16
24

HTTP Request

GET http://2.bp.blogspot.com/-EHe6xsLnYmU/U2TlBxv1nnI/AAAAAAAACfo/D-96xA2HR4Q/s300/cd70urj9cakqq0vzes8w.jpg

HTTP Response

200
142.250.179.238:443

https://sites.google.com/site/superdicasblogspot/pagenavi2.js

tls, http2

msedge.exe

1.9kB
9.8kB
17
20

HTTP Request

GET https://sites.google.com/site/superdicasblogspot/pagenavi2.js
142.250.180.1:80

http://4.bp.blogspot.com/-hBVR2SqENA8/T9fQYnkaRXI/AAAAAAAAASI/PUALuhnBwyY/s1600/Meio-Post.png

http

msedge.exe

1.4kB
12.4kB
13
16

HTTP Request

GET http://4.bp.blogspot.com/-7RfrtSkLvfI/T9fUEK9EgVI/AAAAAAAAATI/qyKUOYkpkas/s1600/buscar.png

HTTP Response

200

HTTP Request

GET http://4.bp.blogspot.com/-hBVR2SqENA8/T9fQYnkaRXI/AAAAAAAAASI/PUALuhnBwyY/s1600/Meio-Post.png

HTTP Response

200
142.250.180.1:80

http://4.bp.blogspot.com/-uNfZJ1N3FdE/T9fQO0MKblI/AAAAAAAAASA/HOIyhTA8UN0/s1600/Topo-Post.png

http

msedge.exe

2.1kB
85.3kB
37
66

HTTP Request

GET http://4.bp.blogspot.com/-uNfZJ1N3FdE/T9fQO0MKblI/AAAAAAAAASA/HOIyhTA8UN0/s1600/Topo-Post.png

HTTP Response

200
142.250.180.1:80

http://3.bp.blogspot.com/-Fb8PNf6bqLE/VC6XyfoW53I/AAAAAAAAIAU/zt2LQ7VlLgo/s300/CAPA.jpg

http

msedge.exe

1.8kB
37.3kB
28
32

HTTP Request

GET http://3.bp.blogspot.com/-Fb8PNf6bqLE/VC6XyfoW53I/AAAAAAAAIAU/zt2LQ7VlLgo/s300/CAPA.jpg

HTTP Response

200
199.232.192.193:80

http://i.imgur.com/M9P0E3q.jpg

http

msedge.exe

583 B
651 B
5
5

HTTP Request

GET http://i.imgur.com/M9P0E3q.jpg

HTTP Response

301
199.232.192.193:443

https://i.imgur.com/vp0rh.png

tls, http2

msedge.exe

4.6kB
159.5kB
74
132

HTTP Request

GET https://i.imgur.com/5efYNqX.jpg

HTTP Request

GET https://i.imgur.com/M9P0E3q.jpg

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://i.imgur.com/vp0rh.png

HTTP Response

200
142.250.187.238:443

https://goo.gl/ymK7Q

tls, http2

msedge.exe

2.0kB
16.9kB
18
23

HTTP Request

GET https://goo.gl/ymK7Q
142.250.180.1:80

http://2.bp.blogspot.com/-BucR4RD8khs/VCdYqmpNMvI/AAAAAAAASMU/J60zfMa02lo/s320/poster.jpg

http

msedge.exe

1.2kB
29.3kB
17
26

HTTP Request

GET http://2.bp.blogspot.com/-BucR4RD8khs/VCdYqmpNMvI/AAAAAAAASMU/J60zfMa02lo/s320/poster.jpg

HTTP Response

200
199.232.192.193:443

i.imgur.com

tls

msedge.exe

839 B
5.3kB
7
8
142.250.180.1:80

http://3.bp.blogspot.com/-D--Nx7RNd74/VCMbEnCHKxI/AAAAAAAAVvI/EAAQUoEUb1k/s1600/ffgfgfg.jpg

http

msedge.exe

1.1kB
25.9kB
16
24

HTTP Request

GET http://3.bp.blogspot.com/-D--Nx7RNd74/VCMbEnCHKxI/AAAAAAAAVvI/EAAQUoEUb1k/s1600/ffgfgfg.jpg

HTTP Response

200
142.250.180.1:80

http://3.bp.blogspot.com/-Qv51zFvgr3I/T9fRGsgbaDI/AAAAAAAAASg/BVxxJrIeiHw/s1600/Topo_Sidebar.png

http

msedge.exe

3.9kB
104.4kB
55
82

HTTP Request

GET http://3.bp.blogspot.com/-lw_xzVZ04nE/VB0znFsFUhI/AAAAAAAAU7s/lG9cFTnAvBw/s1600/licoesdavidaok.jpg

HTTP Response

200

HTTP Request

GET http://3.bp.blogspot.com/-Qv51zFvgr3I/T9fRGsgbaDI/AAAAAAAAASg/BVxxJrIeiHw/s1600/Topo_Sidebar.png

HTTP Response

200
142.250.180.1:80

http://3.bp.blogspot.com/-Ay0YHuSsj0o/VCBmAVBOZoI/AAAAAAAASCs/712LJDRKzyg/s1600/capa1.jpg

http

msedge.exe

12.3kB
579.6kB
246
420

HTTP Request

GET http://3.bp.blogspot.com/-Ay0YHuSsj0o/VCBmAVBOZoI/AAAAAAAASCs/712LJDRKzyg/s1600/capa1.jpg

HTTP Response

200
142.250.180.1:80

http://3.bp.blogspot.com/-9aAKBlbCtUI/VCCLJIt8B9I/AAAAAAAAU84/Yzn9VKwmTdw/s1600/o%2Bamor%2Bmora%2Bao%2Blado2.jpg

http

msedge.exe

2.1kB
48.3kB
33
40

HTTP Request

GET http://3.bp.blogspot.com/-9aAKBlbCtUI/VCCLJIt8B9I/AAAAAAAAU84/Yzn9VKwmTdw/s1600/o%2Bamor%2Bmora%2Bao%2Blado2.jpg

HTTP Response

200
142.250.180.1:80

http://1.bp.blogspot.com/-riaSqytpoy0/T9fRNcaLEqI/AAAAAAAAASo/PqYpjnGmebc/s1600/Meio_Sidebar.png

http

msedge.exe

1.6kB
22.3kB
16
23

HTTP Request

GET http://1.bp.blogspot.com/-REl-EW3L8gE/T9fWZuORCaI/AAAAAAAAATw/4MOrP-bcBZ0/s1600/Proximo.png

HTTP Response

200

HTTP Request

GET http://1.bp.blogspot.com/-riaSqytpoy0/T9fRNcaLEqI/AAAAAAAAASo/PqYpjnGmebc/s1600/Meio_Sidebar.png

HTTP Response

200
37.187.129.45:80

http://counter6.statcounterfree.com/private/webcontadores.php?c=958dece031670ca13c7b437226a0380d

http

msedge.exe

695 B
3.1kB
6
6

HTTP Request

GET http://counter6.statcounterfree.com/private/webcontadores.php?c=958dece031670ca13c7b437226a0380d

HTTP Response

200
142.250.180.1:80

http://1.bp.blogspot.com/-jtSfWxFOVAA/T9Jy88d8HwI/AAAAAAAAAP4/UPXWRvFTZF0/s1600/jfiwm0.png

http

msedge.exe

781 B
3.7kB
8
8

HTTP Request

GET http://1.bp.blogspot.com/-jtSfWxFOVAA/T9Jy88d8HwI/AAAAAAAAAP4/UPXWRvFTZF0/s1600/jfiwm0.png

HTTP Response

200
163.70.151.35:445

www.facebook.com

260 B
5
74.125.206.84:443

https://accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D7332739211150558424%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByMwMDAwMDAiByMwMDAwMDAqByNGRkZGRkYyByMwMDAwMDA6ByMwMDAwMDBCByMwMDAwMDBKByMwMDAwMDBSByNGRkZGRkZaC3RyYW5zcGFyZW50%26pageSize%3D21%26origin%3Dhttp://viciadosemfilmesgratis.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.JisoxTPHVRs.O/am%253DAAAC/d%253D1/rs%253DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D7332739211150558424%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByMwMDAwMDAiByMwMDAwMDAqByNGRkZGRkYyByMwMDAwMDA6ByMwMDAwMDBCByMwMDAwMDBKByMwMDAwMDBSByNGRkZGRkZaC3RyYW5zcGFyZW50%26pageSize%3D21%26origin%3Dhttp://viciadosemfilmesgratis.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.JisoxTPHVRs.O/am%253DAAAC/d%253D1/rs%253DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/m%253D__features__%26bpli%3D1&go=true

tls, http2

msedge.exe

2.7kB
7.8kB
17
18

HTTP Request

GET https://accounts.google.com/ServiceLogin?passive=true&continue=https://www.blogger.com/followers.g?blogID%3D7332739211150558424%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByMwMDAwMDAiByMwMDAwMDAqByNGRkZGRkYyByMwMDAwMDA6ByMwMDAwMDBCByMwMDAwMDBKByMwMDAwMDBSByNGRkZGRkZaC3RyYW5zcGFyZW50%26pageSize%3D21%26origin%3Dhttp://viciadosemfilmesgratis.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.JisoxTPHVRs.O/am%253DAAAC/d%253D1/rs%253DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/m%253D__features__%26bpli%3D1&followup=https://www.blogger.com/followers.g?blogID%3D7332739211150558424%26colors%3DCgt0cmFuc3BhcmVudBILdHJhbnNwYXJlbnQaByMwMDAwMDAiByMwMDAwMDAqByNGRkZGRkYyByMwMDAwMDA6ByMwMDAwMDBCByMwMDAwMDBKByMwMDAwMDBSByNGRkZGRkZaC3RyYW5zcGFyZW50%26pageSize%3D21%26origin%3Dhttp://viciadosemfilmesgratis.blogspot.com/%26usegapi%3D1%26jsh%3Dm;/_/scs/abc-static/_/js/k%253Dgapi.lb.en.JisoxTPHVRs.O/am%253DAAAC/d%253D1/rs%253DAHpOoo9VOmUKkb8FAwL65OiDUU4etqWcRg/m%253D__features__%26bpli%3D1&go=true
23.62.61.97:443

https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

tls, http2

1.4kB
6.4kB
16
12

HTTP Request

GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

tls, http2

31.8kB
883.3kB
648
646

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

8.8.8.8:53

232.168.11.51.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

232.168.11.51.in-addr.arpa
8.8.8.8:53

www.blogger.com

dns

msedge.exe

61 B
108 B
1
1

DNS Request

www.blogger.com

DNS Response

142.250.178.9
8.8.8.8:53

dl.dropbox.com

dns

msedge.exe

60 B
121 B
1
1

DNS Request

dl.dropbox.com

DNS Response

162.125.64.15
8.8.8.8:53

halotemplates.s3.amazonaws.com

dns

msedge.exe

76 B
238 B
1
1

DNS Request

halotemplates.s3.amazonaws.com

DNS Response

52.95.131.21

52.95.130.81

52.95.131.185

52.95.131.145

52.95.128.140

52.95.129.177

52.95.130.189

52.95.134.156
8.8.8.8:53

73.31.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

73.31.126.40.in-addr.arpa
8.8.8.8:53

s7.addthis.com

dns

msedge.exe

60 B
169 B
1
1

DNS Request

s7.addthis.com

DNS Response

104.68.81.91
142.250.178.9:443

www.blogger.com

https

msedge.exe

5.3kB
10.2kB
22
24
8.8.8.8:53

www.akaluma.me

dns

msedge.exe

60 B
126 B
1
1

DNS Request

www.akaluma.me
8.8.8.8:53

goo.gl

dns

msedge.exe

52 B
68 B
1
1

DNS Request

goo.gl

DNS Response

142.250.187.238
8.8.8.8:53

ajax.googleapis.com

dns

msedge.exe

65 B
81 B
1
1

DNS Request

ajax.googleapis.com

DNS Response

142.250.187.234
8.8.8.8:53

4.bp.blogspot.com

dns

msedge.exe

63 B
124 B
1
1

DNS Request

4.bp.blogspot.com

DNS Response

142.250.180.1
8.8.8.8:53

apis.google.com

dns

msedge.exe

61 B
98 B
1
1

DNS Request

apis.google.com

DNS Response

142.250.200.14
8.8.8.8:53

1.bp.blogspot.com

dns

msedge.exe

63 B
124 B
1
1

DNS Request

1.bp.blogspot.com

DNS Response

142.250.180.1
8.8.8.8:53

2.bp.blogspot.com

dns

msedge.exe

63 B
124 B
1
1

DNS Request

2.bp.blogspot.com

DNS Response

142.250.180.1
8.8.8.8:53

sites.google.com

dns

msedge.exe

62 B
78 B
1
1

DNS Request

sites.google.com

DNS Response

142.250.179.238
8.8.8.8:53

resources.blogblog.com

dns

msedge.exe

68 B
115 B
1
1

DNS Request

resources.blogblog.com

DNS Response

142.250.178.9
8.8.8.8:53

3.bp.blogspot.com

dns

msedge.exe

63 B
124 B
1
1

DNS Request

3.bp.blogspot.com

DNS Response

142.250.180.1
8.8.8.8:53

i.imgur.com

dns

msedge.exe

57 B
128 B
1
1

DNS Request

i.imgur.com

DNS Response

199.232.192.193

199.232.196.193
8.8.8.8:53

counter6.statcounterfree.com

dns

msedge.exe

74 B
90 B
1
1

DNS Request

counter6.statcounterfree.com

DNS Response

37.187.129.45
142.250.200.14:443

apis.google.com

https

msedge.exe

5.2kB
66.9kB
32
53
8.8.8.8:53

www.facebook.com

dns

62 B
107 B
1
1

DNS Request

www.facebook.com

DNS Response

163.70.151.35
8.8.8.8:53

9.178.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

9.178.250.142.in-addr.arpa
8.8.8.8:53

15.64.125.162.in-addr.arpa

dns

72 B
122 B
1
1

DNS Request

15.64.125.162.in-addr.arpa
8.8.8.8:53

21.131.95.52.in-addr.arpa

dns

71 B
118 B
1
1

DNS Request

21.131.95.52.in-addr.arpa
8.8.8.8:53

91.81.68.104.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

91.81.68.104.in-addr.arpa
8.8.8.8:53

238.187.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

238.187.250.142.in-addr.arpa
8.8.8.8:53

14.200.250.142.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

14.200.250.142.in-addr.arpa
8.8.8.8:53

1.180.250.142.in-addr.arpa

dns

72 B
110 B
1
1

DNS Request

1.180.250.142.in-addr.arpa
8.8.8.8:53

193.192.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

193.192.232.199.in-addr.arpa
8.8.8.8:53

45.129.187.37.in-addr.arpa

dns

72 B
111 B
1
1

DNS Request

45.129.187.37.in-addr.arpa
8.8.8.8:53

238.179.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

238.179.250.142.in-addr.arpa
8.8.8.8:53

234.187.250.142.in-addr.arpa

dns

74 B
113 B
1
1

DNS Request

234.187.250.142.in-addr.arpa
142.250.179.238:443

sites.google.com

https

msedge.exe

3.7kB
8.4kB
10
12
8.8.8.8:53

accounts.google.com

dns

msedge.exe

65 B
81 B
1
1

DNS Request

accounts.google.com

DNS Response

74.125.206.84
74.125.206.84:443

accounts.google.com

https

msedge.exe

5.0kB
12.4kB
17
21
8.8.8.8:53

84.206.125.74.in-addr.arpa

dns

72 B
105 B
1
1

DNS Request

84.206.125.74.in-addr.arpa
8.8.8.8:53

www.facebook.com

dns

62 B
107 B
1
1

DNS Request

www.facebook.com

DNS Response

157.240.221.35
8.8.8.8:53

26.35.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

26.35.223.20.in-addr.arpa
8.8.8.8:53

97.61.62.23.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

97.61.62.23.in-addr.arpa
224.0.0.251:5353

msedge.exe

586 B
9
8.8.8.8:53

97.17.167.52.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

97.17.167.52.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

19.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

19.229.111.52.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

124 B
346 B
2
2

DNS Request

tse1.mm.bing.net

DNS Request

tse1.mm.bing.net

DNS Response

204.79.197.200

13.107.21.200

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

57.169.31.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

57.169.31.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8bb93aee2ab6bcf10e7cfe28336b8818

SHA1
a45a05dd4e5de2ab52281c0ca4b408ce002626e2

SHA256
3a193f473f9aeba6e8495459e074efaa3acac98edb4228bd798080691da42ae5

SHA512
f989cf830e97cf74e254b1a8758f705b056c3afcf01ead4d5d039d36c5d2eec97c0f88a860e4fe909d96e20f778834dfb90ae1c0ec3316599a6d621c01a34d60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
762bba86499504dc28d1c50a056450f6

SHA1
7f2d567e7e9df989c865f5d6e34d50cbe5b3e588

SHA256
7d703b988f4dfd0d3205f11eac1e55663472ab17927e107605dafa3657a937f3

SHA512
4b46cdd3c50e06d5c7ad110a380df790cc9528c1269aff5105c99999dc9061346a678798903ab4f08c3afaa10a1fc4f2bad1740d40271de6e6f705d96e5108fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13177debd91d896dc69f38a1cab61641

SHA1
35b010d6e9e8b5574577333197dc5b3ede85fe0a

SHA256
06e472d326240c95d55e7934ed643a0d8e3b92a06c0861271e75f1e69e63eead

SHA512
ec7370faf255b6791d020278bbc1774bc624cb742a33b713014f8ae6bb9c24a833f8409e30598d5ffae7a6fb73553889941ce59b601e6250aa8e39b3e55ad74b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
46d0047488e3fbe96e7695c56f76f7c4

SHA1
a0cdcf09b695c863648203ff1437ff9d30af07ac

SHA256
ae602e5461ef6f3f74a87e689f4d1661a92d7f6bec50bc9a17938e469688a278

SHA512
8e58dfef47de42435d4e5cada924289565637dc987b2f8b31798a042969b0e3776a5d18dd53c22b5ff93eb2387f1ddf1a1448bc3c0f7b93220ba6b4407babfdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
f33780594326e6f7175c16bdfc9fe9c2

SHA1
7429235ce46ee21c1c15ac76bc467bf06003ff6b

SHA256
c4141ecfa2571c0f1698a3cb5c895e0dea7058145b878f27f61167d5183c8b71

SHA512
ac59b307d733ca27977d526005d13887d5c8f3b2d55caf5a16c91bf43e1ea16633c7a1b29c25ad59670ded5b87da9d161d2b6564e78ef9d0038a3eb0479db2fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d9a7.TMP

Filesize
874B

MD5
62bf283120afd5d277c289507720954c

SHA1
56339f0cf86bf9822e21a22f922d520adfb14c72

SHA256
8f58fae9737c2952f465d9af135af57b93635f81e23b3de86111593e2518bd2d

SHA512
d5d92e4a474214d0fe8adefa86b1a7f2adfa449065356c436a576dc1b1191170ea069372fad9d5a37ae2c880faf6c86e12af1cd7accd483122bc0c2e69c9b397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
70b40304126947fecf9c51031fa3a4ac

SHA1
8ace4c90f4851ac582d6ec994a0b0009ff7a0721

SHA256
8e533eb0fb4e760d227a44264aaa3c9937c1e0d76df61437f774b3b10f51e43f

SHA512
34bcd07b78467fae176a5f0c8c7271783c21ddf403ce2752b15e3164865b7ea72a7797e5844cf74dcf75c03fbe81d94c5918d8b94b0c8728e201f642369e35df

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response