Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
27/07/2024, 22:39 UTC
General
-
Target
Setup.exe
-
Size
17.0MB
-
MD5
39b6666813ca7dec9a5badc3f260d61e
-
SHA1
0225465060612c872b76d15a66d817692d5d3141
-
SHA256
1dd1d95832125dfb8f2a472d5394f6d3943f55e1cd53de38b2e21335c22cb0f5
-
SHA512
9852d4d3120fd23641104fa9e9fca936ff313c948e9d144343f32d6ba58897dec6dda8a49501e0d3a2363347aa5e6ea7e824f5c6f8ab68c3bb8af994cfbc52a5
-
SSDEEP
98304:KOR0QzG1Fv+ysIhnQKzgGf4fo+jC9DSp/F1vjrWLeJH9BAx68xFnxS8R:KOwFnJUC9DSpNdy6V8xFnxTR
Score
10/10
Malware Config
Extracted
Family
lumma
C2
https://pallmusksopzm.shop/api
https://horizonvxjis.shop/api
https://effectivedoxzj.shop/api
https://parntorpkxzlp.shop/api
https://stimultaionsppzv.shop/api
https://grassytaisol.shop/api
https://broccoltisop.shop/api
https://shellfyyousdjz.shop/api
https://bravedreacisopm.shop/api
Extracted
Family
lumma
C2
https://pallmusksopzm.shop/api
https://horizonvxjis.shop/api
https://effectivedoxzj.shop/api
https://parntorpkxzlp.shop/api
https://stimultaionsppzv.shop/api
https://grassytaisol.shop/api
https://broccoltisop.shop/api
https://shellfyyousdjz.shop/api
https://bravedreacisopm.shop/api
Signatures
-
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
-
Executes dropped EXE 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Backup2\HZTJSVUZFZISJ\StrCmp.exeC:\Users\Admin\AppData\Roaming\Backup2\HZTJSVUZFZISJ\StrCmp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\more.comC:\Windows\SysWOW64\more.com2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\SearchIndexer.exeC:\Windows\SysWOW64\SearchIndexer.exe3⤵
- System Location Discovery: System Language Discovery
-
-
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS58.55.71.13.in-addr.arpaRemote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
DNS240.143.123.92.in-addr.arpaRemote address:8.8.8.8:53Request240.143.123.92.in-addr.arpaIN PTRResponse240.143.123.92.in-addr.arpaIN PTRa92-123-143-240deploystaticakamaitechnologiescom
-
DNS138.201.86.20.in-addr.arpaRemote address:8.8.8.8:53Request138.201.86.20.in-addr.arpaIN PTRResponse
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS21.58.20.217.in-addr.arpaRemote address:8.8.8.8:53Request21.58.20.217.in-addr.arpaIN PTRResponse
-
DNSpallmusksopzm.shopRemote address:8.8.8.8:53Requestpallmusksopzm.shopIN AResponsepallmusksopzm.shopIN A172.67.181.25pallmusksopzm.shopIN A104.21.64.104
-
POSThttps://pallmusksopzm.shop/apiRemote address:172.67.181.25:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: pallmusksopzm.shop
ResponseHTTP/1.1 200 OK
Date: Sat, 27 Jul 2024 22:41:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=bsgjs5gqbr93bmbpt7osc4cjkp; expires=Wed, 20-Nov-2024 16:27:44 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E48qjMERyrAz7bXp%2FTI3ZXM6jGurw7XlCkheULH0wWfx2zfZ7VUa%2BaQqfvbcVm3sX2fd2KvkbVg1vyN4F17glov7xhet0S8%2Fmil9DfyH8WjLX5GcsSsZaEdYKSOwfZFpahAM0BM%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8aa022893ec70716-LHR
alt-svc: h3=":443"; ma=86400
-
DNShorizonvxjis.shopRemote address:8.8.8.8:53Requesthorizonvxjis.shopIN AResponsehorizonvxjis.shopIN A172.67.171.132horizonvxjis.shopIN A104.21.87.243
-
POSThttps://horizonvxjis.shop/apiRemote address:172.67.171.132:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: horizonvxjis.shop
ResponseHTTP/1.1 200 OK
Date: Sat, 27 Jul 2024 22:41:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=8fk0v1gal7b1614psrsvpq0p7a; expires=Wed, 20-Nov-2024 16:27:44 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MdcDTSaTiRVED%2Fd36jwSs4va31pvZ0kYCjOxa4y3hfONNftjE6GFhO20rYhLyRUGbDK5sk3BcqIoIui%2FRbP0vyhnp1d%2F99sv4teykRfXED%2FNTpeQnkM19VNIYxTlGyOLaUBhvA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8aa0228b2fa09484-LHR
alt-svc: h3=":443"; ma=86400
-
DNS25.181.67.172.in-addr.arpaRemote address:8.8.8.8:53Request25.181.67.172.in-addr.arpaIN PTRResponse
-
DNSeffectivedoxzj.shopRemote address:8.8.8.8:53Requesteffectivedoxzj.shopIN AResponseeffectivedoxzj.shopIN A172.67.184.172effectivedoxzj.shopIN A104.21.43.196
-
POSThttps://effectivedoxzj.shop/apiRemote address:172.67.184.172:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: effectivedoxzj.shop
ResponseHTTP/1.1 200 OK
Date: Sat, 27 Jul 2024 22:41:06 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=7071sjiqhnfdkdduprnsqhrm1r; expires=Wed, 20-Nov-2024 16:27:45 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0mYjAYsZUsKgmAZZNGIx7Cuk1ADRyCnRuGvAyjXaY2SYRkuq68rq1WpRmAg6nMUc4lplFPwZVbyXXFoPb%2FEc5o0gLc9JcbNGKqlkvVRCcDIuAA6odF17OHPDrwAfy%2Bwzqnq0clRw"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8aa0228d1dd7bf0d-LHR
alt-svc: h3=":443"; ma=86400
-
DNSparntorpkxzlp.shopRemote address:8.8.8.8:53Requestparntorpkxzlp.shopIN AResponseparntorpkxzlp.shopIN A172.67.166.37parntorpkxzlp.shopIN A104.21.11.139
-
POSThttps://parntorpkxzlp.shop/apiRemote address:172.67.166.37:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: parntorpkxzlp.shop
ResponseHTTP/1.1 200 OK
Date: Sat, 27 Jul 2024 22:41:06 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=3l5eo3a9t6odr49mdjtb1hblo5; expires=Wed, 20-Nov-2024 16:27:45 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o3k2ralz%2Fcz52UUp79%2BYshW1eG0bRRbP4QWrWHmFRgBUMAYtY0IOeVhpGfVic1CWB05uR6sL1g5e%2Fg7LgvSwen9JqjZUcGn4WsDQiL5thodUexZ7nCXk%2BlpjEmH6SmIFomcO%2FAc%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8aa0228eea539559-LHR
alt-svc: h3=":443"; ma=86400
-
DNSstimultaionsppzv.shopRemote address:8.8.8.8:53Requeststimultaionsppzv.shopIN AResponsestimultaionsppzv.shopIN A172.67.210.249stimultaionsppzv.shopIN A104.21.61.140
-
POSThttps://stimultaionsppzv.shop/apiRemote address:172.67.210.249:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: stimultaionsppzv.shop
ResponseHTTP/1.1 200 OK
Date: Sat, 27 Jul 2024 22:41:06 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=lrs527rs8bjsho9bdnde9ob6gr; expires=Wed, 20-Nov-2024 16:27:45 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ODWgKun6ZOUy9GPAwfCsbnmDZMYjw71%2BGOnxwvSgFxzspVbQH8sAySmztppKIEB9cg6jw2rbwQvUbuYYmgQE%2FCfZEtj3eiMkR1HVhxVJolofl3n%2BuxJZRcerEKdACkrk6Gktz9TRP1o%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8aa02290d8cc63b7-LHR
alt-svc: h3=":443"; ma=86400
-
DNSgrassytaisol.shopRemote address:8.8.8.8:53Requestgrassytaisol.shopIN AResponsegrassytaisol.shopIN A104.21.35.114grassytaisol.shopIN A172.67.218.232
-
POSThttps://grassytaisol.shop/apiRemote address:104.21.35.114:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: grassytaisol.shop
ResponseHTTP/1.1 200 OK
Date: Sat, 27 Jul 2024 22:41:07 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=ve51bi0jcgjbhpds6h1f30oa04; expires=Wed, 20-Nov-2024 16:27:46 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W6va0tQRijWSKCHDikmYvLeSbX8%2BpQUo833OsD7KduXPnCvWU1T0lnDBd4hd8n%2B0c5mo%2B50c3cl5DVs3L4ecxiU0cGTxBISUgtzQyIE4Hqvj7es0v8TB5eoXNE9xGOOUHI6N5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8aa02292da51be9b-LHR
alt-svc: h3=":443"; ma=86400
-
DNS172.184.67.172.in-addr.arpaRemote address:8.8.8.8:53Request172.184.67.172.in-addr.arpaIN PTRResponse
-
DNS37.166.67.172.in-addr.arpaRemote address:8.8.8.8:53Request37.166.67.172.in-addr.arpaIN PTRResponse
-
DNS249.210.67.172.in-addr.arpaRemote address:8.8.8.8:53Request249.210.67.172.in-addr.arpaIN PTRResponse
-
DNS132.171.67.172.in-addr.arpaRemote address:8.8.8.8:53Request132.171.67.172.in-addr.arpaIN PTRResponse
-
DNSbroccoltisop.shopRemote address:8.8.8.8:53Requestbroccoltisop.shopIN AResponsebroccoltisop.shopIN A104.21.65.200broccoltisop.shopIN A172.67.166.139
-
POSThttps://broccoltisop.shop/apiRemote address:104.21.65.200:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: broccoltisop.shop
ResponseHTTP/1.1 200 OK
Date: Sat, 27 Jul 2024 22:41:07 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=fjknq0sohhjp4kiv0tn7hac2m5; expires=Wed, 20-Nov-2024 16:27:46 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eApynFNSxgIqbXNkjOapx9n%2BV8juclzPaHdQZqa%2Bc3TvDSVOVWedZJ6E07XEDourC5Gpx0n1wEyCb7i%2BI0NQB512q7MufYjpiD9nqY%2BccDfDwmlvfE35jtGo5kzk37%2BgO4QT%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8aa02294abdf63dc-LHR
alt-svc: h3=":443"; ma=86400
-
DNSshellfyyousdjz.shopRemote address:8.8.8.8:53Requestshellfyyousdjz.shopIN AResponseshellfyyousdjz.shopIN A104.21.66.193shellfyyousdjz.shopIN A172.67.163.233
-
POSThttps://shellfyyousdjz.shop/apiRemote address:104.21.66.193:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: shellfyyousdjz.shop
ResponseHTTP/1.1 200 OK
Date: Sat, 27 Jul 2024 22:41:07 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=b0ogmthm25vj8hoqm789k0m8eh; expires=Wed, 20-Nov-2024 16:27:46 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2BrBbuny8HdvEdXyV8%2FEc%2FQshNDa4icDE5nhdLVUU4d5W4SxRa49r4mQVxlz2VuI4z6Rf86xuztwKW9bH7vzD0WMKnF9Gs7pCwNYTiKo8mZFLbALntusuGAcXMlQrqZNNdfY%2BksB"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8aa022968c356551-LHR
alt-svc: h3=":443"; ma=86400
-
DNSbravedreacisopm.shopRemote address:8.8.8.8:53Requestbravedreacisopm.shopIN AResponsebravedreacisopm.shopIN A104.21.58.17bravedreacisopm.shopIN A172.67.197.53
-
POSThttps://bravedreacisopm.shop/apiRemote address:104.21.58.17:443RequestPOST /api HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Content-Length: 8
Host: bravedreacisopm.shop
ResponseHTTP/1.1 200 OK
Date: Sat, 27 Jul 2024 22:41:08 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: PHPSESSID=3b25hm7cv67aob02cj2mnkgvru; expires=Wed, 20-Nov-2024 16:27:47 GMT; Max-Age=9999999; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bxq6pAsmL8QtG83ycZyt2Ai9q67ITwU2e5TaJb88PTgaK5ls53kuvBs7WXlUnFfQCwUyV5cq98tPX3%2F7p14GNdvXDlL9ylYOw8NtQJ5Qfd%2BEfZIfnR9KLGxj%2FiMHyde6VvnOcEqJsA%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8aa022987ee87768-LHR
alt-svc: h3=":443"; ma=86400
-
DNS114.35.21.104.in-addr.arpaRemote address:8.8.8.8:53Request114.35.21.104.in-addr.arpaIN PTRResponse
-
DNS200.65.21.104.in-addr.arpaRemote address:8.8.8.8:53Request200.65.21.104.in-addr.arpaIN PTRResponse
-
DNS193.66.21.104.in-addr.arpaRemote address:8.8.8.8:53Request193.66.21.104.in-addr.arpaIN PTRResponse
-
DNSsteamcommunity.comRemote address:8.8.8.8:53Requeststeamcommunity.comIN AResponsesteamcommunity.comIN A23.214.143.155
-
GEThttps://steamcommunity.com/profiles/76561199724331900Remote address:23.214.143.155:443RequestGET /profiles/76561199724331900 HTTP/1.1
Connection: Keep-Alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Host: steamcommunity.com
ResponseHTTP/1.1 200 OK
Server: nginx
Content-Type: text/html; charset=UTF-8
Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-cache
Date: Sat, 27 Jul 2024 22:41:08 GMT
Content-Length: 34774
Connection: keep-alive
Set-Cookie: sessionid=26cd7abd452478ca0d0a935c; Path=/; Secure; SameSite=None
Set-Cookie: steamCountry=GB%7C0cca5b35055ce513436d8b708d875660; Path=/; Secure; HttpOnly; SameSite=None
-
DNSreinforcedirectorywd.shopRemote address:8.8.8.8:53Requestreinforcedirectorywd.shopIN AResponse
-
DNS155.143.214.23.in-addr.arpaRemote address:8.8.8.8:53Request155.143.214.23.in-addr.arpaIN PTRResponse155.143.214.23.in-addr.arpaIN PTRa23-214-143-155deploystaticakamaitechnologiescom
-
DNS17.58.21.104.in-addr.arpaRemote address:8.8.8.8:53Request17.58.21.104.in-addr.arpaIN PTRResponse
-
DNS26.35.223.20.in-addr.arpaRemote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388038_1RWYOHY1X3SG16VKA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239339388038_1RWYOHY1X3SG16VKA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 747557
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3D65359115B3416A80A99B2D73F6FE9A Ref B: LON04EDGE1219 Ref C: 2024-07-27T22:42:02Z
date: Sat, 27 Jul 2024 22:42:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317300980_1Y89D7707MB791W26&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317300980_1Y89D7707MB791W26&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 597361
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3ED12A8D39DB448686B872E4FC9A15FD Ref B: LON04EDGE1219 Ref C: 2024-07-27T22:42:02Z
date: Sat, 27 Jul 2024 22:42:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388039_1SUI2NOXAULEFZLP3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239339388039_1SUI2NOXAULEFZLP3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 678410
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4132AF6712AB483599C14B7BFEB6B977 Ref B: LON04EDGE1219 Ref C: 2024-07-27T22:42:02Z
date: Sat, 27 Jul 2024 22:42:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418569_13408TD3CSPQQLS8W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239340418569_13408TD3CSPQQLS8W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 815230
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F9AA30161DD64A4CBBC2B937028160A0 Ref B: LON04EDGE1219 Ref C: 2024-07-27T22:42:02Z
date: Sat, 27 Jul 2024 22:42:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301413_1FLIQOLD75SBT6IE1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239317301413_1FLIQOLD75SBT6IE1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 477941
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 158496F0AF7C4619B2BF62B0FC3CD660 Ref B: LON04EDGE1219 Ref C: 2024-07-27T22:42:02Z
date: Sat, 27 Jul 2024 22:42:01 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418570_1AILBHE008ZL9RHPC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.28.10:443RequestGET /th?id=OADD2.10239340418570_1AILBHE008ZL9RHPC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 712130
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2BACBD45ACFF409E9192F6CC7471827E Ref B: LON04EDGE1219 Ref C: 2024-07-27T22:42:03Z
date: Sat, 27 Jul 2024 22:42:02 GMT
-
DNS10.28.171.150.in-addr.arpaRemote address:8.8.8.8:53Request10.28.171.150.in-addr.arpaIN PTRResponse
-
172.67.181.25:443https://pallmusksopzm.shop/apitls, http
HTTP Request
POST https://pallmusksopzm.shop/apiHTTP Response
200 -
172.67.171.132:443https://horizonvxjis.shop/apitls, http
HTTP Request
POST https://horizonvxjis.shop/apiHTTP Response
200 -
172.67.184.172:443https://effectivedoxzj.shop/apitls, http
HTTP Request
POST https://effectivedoxzj.shop/apiHTTP Response
200 -
172.67.166.37:443https://parntorpkxzlp.shop/apitls, http
HTTP Request
POST https://parntorpkxzlp.shop/apiHTTP Response
200 -
172.67.210.249:443https://stimultaionsppzv.shop/apitls, http
HTTP Request
POST https://stimultaionsppzv.shop/apiHTTP Response
200 -
104.21.35.114:443https://grassytaisol.shop/apitls, http
HTTP Request
POST https://grassytaisol.shop/apiHTTP Response
200 -
104.21.65.200:443https://broccoltisop.shop/apitls, http
HTTP Request
POST https://broccoltisop.shop/apiHTTP Response
200 -
104.21.66.193:443https://shellfyyousdjz.shop/apitls, http
HTTP Request
POST https://shellfyyousdjz.shop/apiHTTP Response
200 -
104.21.58.17:443https://bravedreacisopm.shop/apitls, http
HTTP Request
POST https://bravedreacisopm.shop/apiHTTP Response
200 -
23.214.143.155:443https://steamcommunity.com/profiles/76561199724331900tls, http
HTTP Request
GET https://steamcommunity.com/profiles/76561199724331900HTTP Response
200 -
150.171.28.10:443tse1.mm.bing.nettls, http2
-
150.171.28.10:443tse1.mm.bing.nettls, http2
-
150.171.28.10:443tse1.mm.bing.nettls, http2
-
150.171.28.10:443https://tse1.mm.bing.net/th?id=OADD2.10239340418570_1AILBHE008ZL9RHPC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388038_1RWYOHY1X3SG16VKA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317300980_1Y89D7707MB791W26&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388039_1SUI2NOXAULEFZLP3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418569_13408TD3CSPQQLS8W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301413_1FLIQOLD75SBT6IE1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418570_1AILBHE008ZL9RHPC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200
-
8.8.8.8:5358.55.71.13.in-addr.arpadns
DNS Request
58.55.71.13.in-addr.arpa
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:53240.143.123.92.in-addr.arpadns
DNS Request
240.143.123.92.in-addr.arpa
-
8.8.8.8:53138.201.86.20.in-addr.arpadns
DNS Request
138.201.86.20.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:5321.58.20.217.in-addr.arpadns
DNS Request
21.58.20.217.in-addr.arpa
-
8.8.8.8:53pallmusksopzm.shopdns
DNS Request
pallmusksopzm.shop
DNS Response
172.67.181.25104.21.64.104
-
8.8.8.8:53horizonvxjis.shopdns
DNS Request
horizonvxjis.shop
DNS Response
172.67.171.132104.21.87.243
-
8.8.8.8:5325.181.67.172.in-addr.arpadns
DNS Request
25.181.67.172.in-addr.arpa
-
8.8.8.8:53effectivedoxzj.shopdns
DNS Request
effectivedoxzj.shop
DNS Response
172.67.184.172104.21.43.196
-
8.8.8.8:53parntorpkxzlp.shopdns
DNS Request
parntorpkxzlp.shop
DNS Response
172.67.166.37104.21.11.139
-
8.8.8.8:53stimultaionsppzv.shopdns
DNS Request
stimultaionsppzv.shop
DNS Response
172.67.210.249104.21.61.140
-
8.8.8.8:53grassytaisol.shopdns
DNS Request
grassytaisol.shop
DNS Response
104.21.35.114172.67.218.232
-
8.8.8.8:53172.184.67.172.in-addr.arpadns
DNS Request
172.184.67.172.in-addr.arpa
-
8.8.8.8:5337.166.67.172.in-addr.arpadns
DNS Request
37.166.67.172.in-addr.arpa
-
8.8.8.8:53249.210.67.172.in-addr.arpadns
DNS Request
249.210.67.172.in-addr.arpa
-
8.8.8.8:53132.171.67.172.in-addr.arpadns
DNS Request
132.171.67.172.in-addr.arpa
-
8.8.8.8:53broccoltisop.shopdns
DNS Request
broccoltisop.shop
DNS Response
104.21.65.200172.67.166.139
-
8.8.8.8:53shellfyyousdjz.shopdns
DNS Request
shellfyyousdjz.shop
DNS Response
104.21.66.193172.67.163.233
-
8.8.8.8:53bravedreacisopm.shopdns
DNS Request
bravedreacisopm.shop
DNS Response
104.21.58.17172.67.197.53
-
8.8.8.8:53114.35.21.104.in-addr.arpadns
DNS Request
114.35.21.104.in-addr.arpa
-
8.8.8.8:53200.65.21.104.in-addr.arpadns
DNS Request
200.65.21.104.in-addr.arpa
-
8.8.8.8:53193.66.21.104.in-addr.arpadns
DNS Request
193.66.21.104.in-addr.arpa
-
8.8.8.8:53steamcommunity.comdns
DNS Request
steamcommunity.com
DNS Response
23.214.143.155
-
8.8.8.8:53reinforcedirectorywd.shopdns
DNS Request
reinforcedirectorywd.shop
-
8.8.8.8:53155.143.214.23.in-addr.arpadns
DNS Request
155.143.214.23.in-addr.arpa
-
8.8.8.8:5317.58.21.104.in-addr.arpadns
DNS Request
17.58.21.104.in-addr.arpa
-
8.8.8.8:5326.35.223.20.in-addr.arpadns
DNS Request
26.35.223.20.in-addr.arpa
-
8.8.8.8:53tse1.mm.bing.netdns
DNS Request
tse1.mm.bing.net
DNS Response
150.171.28.10150.171.27.10
-
8.8.8.8:5310.28.171.150.in-addr.arpadns
DNS Request
10.28.171.150.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5fa3ee8ebf9cfa0e27c7b70146ae3bca4
SHA11692df2417689987b278eb696de6cd129ed9c023
SHA2561c4a66d0abf09477f10ff7bd44b06e874f07caef6b040368ec44e25f54f22046
SHA5121920272847a301033e1ecaf086954a006aea92188da8ff8183477da615c49ddb5c013873d119875bd3738c04d70ffe09575311ed58355d4ddd8accd7e24eb9d9
-
Filesize
1.1MB
MD5d848064e21172017671bc55ce2d78e90
SHA153a3e81fd07691c111a45fc64d9c2768d9ad853b
SHA256f70f532425d13150e673887c94c1d9a1e98b4b2f7b6d95b9804b6f219b687174
SHA5120f3d07a936f8faca5103c23dcc1eab62eedd6c39b7812dea6c835bf1021fd582cf1734b5ef615fbcc4bb90124e05b9c29d48fe73751a29c855c625230d04fd48
-
Filesize
47KB
MD5916d7425a559aaa77f640710a65f9182
SHA123d25052aef9ba71ddeef7cfa86ee43d5ba1ea13
SHA256118de01fb498e81eab4ade980a621af43b52265a9fcbae5dedc492cdf8889f35
SHA512d0c260a0347441b4e263da52feb43412df217c207eba594d59c10ee36e47e1a098b82ce633851c16096b22f4a4a6f8282bdd23d149e337439fe63a77ec7343bc
-
Filesize
436KB
-
Filesize
436KB
-
Filesize
28KB
-
Filesize
436KB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
2.0MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
3.7MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
8KB
-
Filesize
2.0MB
-
Filesize
1.5MB