xworm | hxxp://nodejs[.]org

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	node.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	XClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Bootstrapper (1).exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Windows Defender.exe

Drops startup file 6 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Data Compiler.lnk	XClient.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsAntivirus.lnk	Bootstrapper (1).exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsAntivirus.lnk	Bootstrapper (1).exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk	Windows Defender.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Defender.lnk	Windows Defender.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Data Compiler.lnk	XClient.exe

Executes dropped EXE 7 IoCs

pid	Process
2304	node.exe
4000	node.exe
1560	node.exe
3308	cmd.exe
4268	XClient.exe
5260	Bootstrapper (1).exe
5528	Windows Defender.exe

Loads dropped DLL 7 IoCs

pid	Process
2476	MsiExec.exe
2476	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
2328	MsiExec.exe
1480	MsiExec.exe
2064	MsiExec.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsAntivirus = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsAntivirus.exe"	Bootstrapper (1).exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Defender.exe"	Windows Defender.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Windows\\System32\\XClient.exe"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bootstrapper (1) = "C:\\Windows\\System32\\Bootstrapper (1).exe"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Windows\\System32\\Windows Defender.exe"	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Data Compiler = "C:\\Users\\Admin\\AppData\\Local\\Windows Data Compiler.exe"	XClient.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2372	cmd.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
83	ip-api.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\System32\XClient.exe	cmd.exe
File opened for modification	C:\Windows\System32\XClient.exe	cmd.exe
File created	C:\Windows\System32\Bootstrapper (1).exe	cmd.exe
File created	C:\Windows\System32\Windows Defender.exe	cmd.exe
File opened for modification	C:\Windows\System32\Windows Defender.exe	cmd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-completion.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-fund.html	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\completion.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\json-parse-even-better-errors\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\protobuf-specs\dist\__generated__\sigstore_trustroot.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\xcodeproj_file.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\ignore-enoent.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\corepack\shims\corepack.ps1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\minipass-fetch\lib\body.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-find-dupes.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@pkgjs\parseargs\internal\errors.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\commonjs\symlink-error.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\esm\create.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\json-stringify-nice\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmexec\lib\get-bin-from-manifest.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\node_modules\spdx-expression-parse\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\shrinkwrap.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\core\dist\json.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\pylib\gyp\common_test.py	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\registry.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\diff\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\esm\fix-eperm.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\sprintf-js\dist\angular-sprintf.min.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\config\lib\type-defs.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\agent\lib\agents.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\link-mans.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\glob\dist\esm\glob.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\rimraf-manual.d.ts	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\validate-npm-package-license\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\make-fetch-happen\lib\cache\key.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmdiff\README.md	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-sized\node_modules\minipass\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\man\man1\npm-help-search.1	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\fs\lib\cp\polyfill.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\package-json\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\fs\lib\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\node_modules\nopt\lib\debug.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\wrap-ansi\node_modules\emoji-regex\es2015\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\balanced-match\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\color-convert\route.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\jsonparse\samplejson\basic2.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\path-scurry\dist\esm\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\strip-trailing-slashes.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\restart.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@isaacs\cliui\node_modules\strip-ansi\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\cacache\node_modules\tar\dist\commonjs\parse.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\rimraf\dist\commonjs\ignore-enoent.js.map	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\supports-color\license	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\update.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\promise-spawn\LICENSE	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\common-ancestor-path\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\tar\lib\large-numbers.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\lib\commands\org.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@sigstore\sign\node_modules\@npmcli\agent\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\package.json	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\semver\functions\compare-loose.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\lib\yarn-lock.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\err-code\index.umd.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\iconv-lite\encodings\utf32.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\indent-string\index.js	msiexec.exe
File created	C:\Program Files\nodejs\node_modules\npm\node_modules\promzard\package.json	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9FC.tmp	msiexec.exe
File created	C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon	msiexec.exe
File created	C:\Windows\Installer\e58fbc2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47B3.tmp	msiexec.exe
File created	C:\Windows\Installer\e58fbc0.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD18.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\NodeIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e58fbc0.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4485.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD86.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI642.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e6cf55ff94a5976e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e6cf55ff0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900e6cf55ff000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de6cf55ff000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000e6cf55ff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\PackageName = "node-v22.11.0-x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\corepack	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\DocumentationShortcuts	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNode = "EnvironmentPath"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPathNpmModules = "EnvironmentPath"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\011B2C6A4395F7A48B1C157EDC15FF28	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\EnvironmentPath	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\PackageCode = "7ADA4E96FE88DF64FB4F54512750A882"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Version = "369819648"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductName = "Node.js"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\ProductIcon = "C:\\Windows\\Installer\\{A6C2B110-5934-4A7F-B8C1-51E7CD51FF82}\\NodeIcon"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings	powershell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\NodeRuntime	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\011B2C6A4395F7A48B1C157EDC15FF28\npm	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\011B2C6A4395F7A48B1C157EDC15FF28\SourceList\Media	msiexec.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 693871.crdownload:SmartScreen	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2688	schtasks.exe
5188	schtasks.exe
5448	schtasks.exe
5496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
972	msedge.exe
972	msedge.exe
828	msedge.exe
828	msedge.exe
1876	identity_helper.exe
1876	identity_helper.exe
4244	msedge.exe
4244	msedge.exe
3268	msiexec.exe
3268	msiexec.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
1052	msedge.exe
4000	node.exe
4000	node.exe
3856	powershell.exe
3856	powershell.exe
3856	powershell.exe
4368	powershell.exe
4368	powershell.exe
4368	powershell.exe
4836	powershell.exe
4836	powershell.exe
4836	powershell.exe
5272	powershell.exe
5272	powershell.exe
5272	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5956	powershell.exe
5956	powershell.exe
5956	powershell.exe
6004	powershell.exe
6004	powershell.exe
6004	powershell.exe
3000	powershell.exe
3000	powershell.exe
3000	powershell.exe
5380	powershell.exe
5380	powershell.exe
5380	powershell.exe
5512	powershell.exe
5512	powershell.exe
5512	powershell.exe
3308	powershell.exe
3308	powershell.exe
3308	powershell.exe
2468	powershell.exe
2468	powershell.exe
2468	powershell.exe
912	powershell.exe
912	powershell.exe
912	powershell.exe
5736	powershell.exe
5736	powershell.exe
5736	powershell.exe
5976	powershell.exe
5976	powershell.exe
5976	powershell.exe
6036	powershell.exe
6036	powershell.exe
6036	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	32	msiexec.exe
Token: SeIncreaseQuotaPrivilege	32	msiexec.exe
Token: SeSecurityPrivilege	3268	msiexec.exe
Token: SeCreateTokenPrivilege	32	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	32	msiexec.exe
Token: SeLockMemoryPrivilege	32	msiexec.exe
Token: SeIncreaseQuotaPrivilege	32	msiexec.exe
Token: SeMachineAccountPrivilege	32	msiexec.exe
Token: SeTcbPrivilege	32	msiexec.exe
Token: SeSecurityPrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeLoadDriverPrivilege	32	msiexec.exe
Token: SeSystemProfilePrivilege	32	msiexec.exe
Token: SeSystemtimePrivilege	32	msiexec.exe
Token: SeProfSingleProcessPrivilege	32	msiexec.exe
Token: SeIncBasePriorityPrivilege	32	msiexec.exe
Token: SeCreatePagefilePrivilege	32	msiexec.exe
Token: SeCreatePermanentPrivilege	32	msiexec.exe
Token: SeBackupPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeShutdownPrivilege	32	msiexec.exe
Token: SeDebugPrivilege	32	msiexec.exe
Token: SeAuditPrivilege	32	msiexec.exe
Token: SeSystemEnvironmentPrivilege	32	msiexec.exe
Token: SeChangeNotifyPrivilege	32	msiexec.exe
Token: SeRemoteShutdownPrivilege	32	msiexec.exe
Token: SeUndockPrivilege	32	msiexec.exe
Token: SeSyncAgentPrivilege	32	msiexec.exe
Token: SeEnableDelegationPrivilege	32	msiexec.exe
Token: SeManageVolumePrivilege	32	msiexec.exe
Token: SeImpersonatePrivilege	32	msiexec.exe
Token: SeCreateGlobalPrivilege	32	msiexec.exe
Token: SeCreateTokenPrivilege	32	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	32	msiexec.exe
Token: SeLockMemoryPrivilege	32	msiexec.exe
Token: SeIncreaseQuotaPrivilege	32	msiexec.exe
Token: SeMachineAccountPrivilege	32	msiexec.exe
Token: SeTcbPrivilege	32	msiexec.exe
Token: SeSecurityPrivilege	32	msiexec.exe
Token: SeTakeOwnershipPrivilege	32	msiexec.exe
Token: SeLoadDriverPrivilege	32	msiexec.exe
Token: SeSystemProfilePrivilege	32	msiexec.exe
Token: SeSystemtimePrivilege	32	msiexec.exe
Token: SeProfSingleProcessPrivilege	32	msiexec.exe
Token: SeIncBasePriorityPrivilege	32	msiexec.exe
Token: SeCreatePagefilePrivilege	32	msiexec.exe
Token: SeCreatePermanentPrivilege	32	msiexec.exe
Token: SeBackupPrivilege	32	msiexec.exe
Token: SeRestorePrivilege	32	msiexec.exe
Token: SeShutdownPrivilege	32	msiexec.exe
Token: SeDebugPrivilege	32	msiexec.exe
Token: SeAuditPrivilege	32	msiexec.exe
Token: SeSystemEnvironmentPrivilege	32	msiexec.exe
Token: SeChangeNotifyPrivilege	32	msiexec.exe
Token: SeRemoteShutdownPrivilege	32	msiexec.exe
Token: SeUndockPrivilege	32	msiexec.exe
Token: SeSyncAgentPrivilege	32	msiexec.exe
Token: SeEnableDelegationPrivilege	32	msiexec.exe
Token: SeManageVolumePrivilege	32	msiexec.exe
Token: SeImpersonatePrivilege	32	msiexec.exe
Token: SeCreateGlobalPrivilege	32	msiexec.exe
Token: SeCreateTokenPrivilege	32	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	32	msiexec.exe
Token: SeLockMemoryPrivilege	32	msiexec.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
32	msiexec.exe
32	msiexec.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe
828	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4268	XClient.exe
5260	Bootstrapper (1).exe
5528	Windows Defender.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 940	828	msedge.exe	83
PID 828 wrote to memory of 940	828	msedge.exe	83
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 1504	828	msedge.exe	84
PID 828 wrote to memory of 972	828	msedge.exe	85
PID 828 wrote to memory of 972	828	msedge.exe	85
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86
PID 828 wrote to memory of 1060	828	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://nodejs.org
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff869e46f8,0x7fff869e4708,0x7fff869e4718
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v22.11.0-x64.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:32
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,841922982331747186,9079320968524817726,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3268
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 57B1215F3256C11C54FE2B60D592A0BF C
  2⤵
  - Loads dropped DLL
  PID:2476
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3604
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DD1BEBDD28C1EA8115005BAF1BDA934A
  2⤵
  - Loads dropped DLL
  PID:2328
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 273866B603360BA98EEF63D00D0225BF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  PID:1480
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 29AE06ED845E81A20B90495F8430F87B
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:1448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
  2⤵
  PID:3480
- - C:\Program Files\nodejs\node.exe
    "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"
    3⤵
    - Executes dropped EXE
    PID:2304
- C:\Program Files\nodejs\node.exe
  "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" i rootkitfix
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c node index.js
    3⤵
    PID:3356
  - - C:\Program Files\nodejs\node.exe
      node index.js
      4⤵
      Executes dropped EXE
      PID:1560
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\2949919bdc4621aa0948e3a78df1224f\execute.bat'" -WindowStyle hidden -Verb runAs"
        5⤵
        Hide Artifacts: Hidden Window
        
        PID:2372
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Start-Process -FilePath "'C:\Users\Admin\AppData\Local\Temp\2949919bdc4621aa0948e3a78df1224f\execute.bat'" -WindowStyle hidden -Verb runAs
        6⤵
        Command and Scripting Interpreter: PowerShell
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:3856
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2949919bdc4621aa0948e3a78df1224f\execute.bat"
        7⤵
        
        PID:4044
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\cmd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cmd.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3308
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4368
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "XClient" /SC ONLOGON /TR "C:\Windows\System32\XClient.exe" /RL HIGHEST
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2688
        
        C:\Windows\System32\XClient.exe
        
        "C:\Windows\System32\XClient.exe"
        9⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:4268
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\XClient.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5724
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5956
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Data Compiler.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3000
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Data Compiler.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3308
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Data Compiler" /tr "C:\Users\Admin\AppData\Local\Windows Data Compiler.exe"
        10⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Bootstrapper (1).exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4836
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "Bootstrapper (1)" /SC ONLOGON /TR "C:\Windows\System32\Bootstrapper (1).exe" /RL HIGHEST
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5188
        
        C:\Windows\System32\Bootstrapper (1).exe
        
        "C:\Windows\System32\Bootstrapper (1).exe"
        9⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:5260
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Bootstrapper (1).exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6004
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Bootstrapper (1).exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5380
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsAntivirus.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsAntivirus.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5736
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows Defender.exe'
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5272
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /F /TN "Windows Defender" /SC ONLOGON /TR "C:\Windows\System32\Windows Defender.exe" /RL HIGHEST
        9⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5448
        
        C:\Windows\System32\Windows Defender.exe
        
        "C:\Windows\System32\Windows Defender.exe"
        9⤵
        Checks computer location settings
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetWindowsHookEx
        
        PID:5528
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\System32\Windows Defender.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5512
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:912
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows Defender.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5976
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Defender.exe'
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6036
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\2949919bdc4621aa0948e3a78df1224f""
        5⤵
        
        PID:5572

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

nodejs.org

msedge.exe

Remote address:

8.8.8.8:53

Request

nodejs.org

IN A

Response

nodejs.org

IN A

104.20.22.46

nodejs.org

IN A

104.20.23.46
GET

http://nodejs.org/

msedge.exe

Remote address:

104.20.22.46:80

Request

GET / HTTP/1.1
Host: nodejs.org
Connection: keep-alive
DNT: 1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 308 Permanent Redirect

Date: Mon, 18 Nov 2024 18:19:22 GMT
Content-Type: text/plain
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://nodejs.org/
Refresh: 0;url=https://nodejs.org/
CF-Cache-Status: DYNAMIC
X-Content-Type-Options: nosniff
Server: cloudflare
CF-RAY: 8e49f7eb38d563b1-LHR
DNS

209.205.72.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.205.72.20.in-addr.arpa

IN PTR

Response
DNS

172.214.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.214.232.199.in-addr.arpa

IN PTR

Response
GET

https://nodejs.org/

msedge.exe

Remote address:

104.20.22.46:443

Request

GET / HTTP/2.0
host: nodejs.org
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 307

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/html
cache-control: public, max-age=0, must-revalidate
location: /en
set-cookie: NEXT_LOCALE=en; Path=/; Expires=Tue, 18 Nov 2025 18:19:23 GMT; Max-Age=31536000; SameSite=lax
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-middleware-set-cookie: NEXT_LOCALE=en; Path=/; Expires=Tue, 18 Nov 2025 18:19:23 GMT; Max-Age=31536000; SameSite=lax
x-vercel-id: lhr1::vchvv-1731953963326-006a4c494ea8
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7eeaac976c3-LHR
GET

https://nodejs.org/en

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /en HTTP/2.0
host: nodejs.org
dnt: 1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/html; charset=utf-8
age: 252
cache-control: public, max-age=0, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
x-matched-path: /[locale]
x-nextjs-prerender: 1
x-nextjs-stale-time: 4294967294
x-powered-by: Next.js
x-vercel-cache: HIT
x-vercel-id: lhr1::iad1::2jdg5-1731953963453-72b7315fd737
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7ef7be276c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/media/3478b6abef19b3b3-s.p.woff2

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/media/3478b6abef19b3b3-s.p.woff2 HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: https://nodejs.org
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: font
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: font/woff2
content-length: 10088
accept-ranges: bytes
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="3478b6abef19b3b3-s.p.woff2"
etag: "eeee8726f3b4ae9d8c710efba031ca6a"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/media/3478b6abef19b3b3-s.p.woff2
x-vercel-cache: HIT
x-vercel-id: lhr1::xv4j7-1731953963693-1c72db6f9b42
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f0fdf076c3-LHR
GET

https://nodejs.org/_next/static/media/3d9ea938b6afa941-s.p.woff2

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/media/3d9ea938b6afa941-s.p.woff2 HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: https://nodejs.org
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: font
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
age: 3594
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="6897a611cf12ddb3.css"
etag: W/"8d51e8e15b69329e29b7b21a92b7034d"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/css/6897a611cf12ddb3.css
x-vercel-cache: HIT
x-vercel-id: lhr1::jqbff-1731953963698-2e37f3798e8d
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10e0076c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/media/be2416cbb012c256-s.p.woff2

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/media/be2416cbb012c256-s.p.woff2 HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
origin: https://nodejs.org
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
dnt: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: font
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: font/woff2
content-length: 10148
accept-ranges: bytes
access-control-allow-origin: *
age: 3180
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="be2416cbb012c256-s.p.woff2"
etag: "d2712b7a0f090540f1308cb3ceff15a6"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/media/be2416cbb012c256-s.p.woff2
x-vercel-cache: HIT
x-vercel-id: lhr1::z6249-1731953963696-274f12b783c1
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10dfb76c3-LHR
GET

https://nodejs.org/_next/static/chunks/webpack-54393cf863545595.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/webpack-54393cf863545595.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="130b83a7fd77c508.css"
etag: W/"34fdc87d76817a6c27c6cdb285c20a21"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/css/130b83a7fd77c508.css
x-vercel-cache: HIT
x-vercel-id: lhr1::xpwxg-1731953963707-2cd867335d57
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10e0976c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/css/e4af37eb9b9d9fd9.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/css/e4af37eb9b9d9fd9.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
age: 1687
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="75023f0f627f7837.css"
etag: W/"f894fe55aa00af498b28d5123ca96e2c"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/css/75023f0f627f7837.css
x-vercel-cache: HIT
x-vercel-id: lhr1::k9nxg-1731953963709-1e2134fedd19
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10e1176c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/css/6897a611cf12ddb3.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/css/6897a611cf12ddb3.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="01b276689d2a382a.css"
etag: W/"2b4c3aa4240e7acb0d216e25de336317"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/css/01b276689d2a382a.css
x-vercel-cache: HIT
x-vercel-id: lhr1::k9nxg-1731953963714-f7d13ff14159
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10e0e76c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/css/2458e5048894197c.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/css/2458e5048894197c.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
age: 4112
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="bac459e8b0eec940.css"
etag: W/"3856b0639f63b9c994c7bf70ade34766"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/css/bac459e8b0eec940.css
x-vercel-cache: HIT
x-vercel-id: lhr1::tqlqh-1731953963703-476b866635e2
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10e1076c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/css/b88317ca289c5746.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/css/b88317ca289c5746.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="2458e5048894197c.css"
etag: W/"47c2046fea5f059c95657b0cb6dcca49"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/css/2458e5048894197c.css
x-vercel-cache: HIT
x-vercel-id: lhr1::fffck-1731953963708-cfeaeba853f4
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10e0676c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/css/130b83a7fd77c508.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/css/130b83a7fd77c508.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: font/woff2
content-length: 43068
accept-ranges: bytes
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="3d9ea938b6afa941-s.p.woff2"
etag: "ee1b2a154fb9ea98a28413a839adedfb"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/media/3d9ea938b6afa941-s.p.woff2
x-vercel-cache: HIT
x-vercel-id: lhr1::9c94c-1731953963705-2b07abc471a4
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f0fdf676c3-LHR
GET

https://nodejs.org/_next/static/css/01b276689d2a382a.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/css/01b276689d2a382a.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
age: 1853
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="b88317ca289c5746.css"
etag: W/"440281a3d4b16601d0d623253f6cf542"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/css/b88317ca289c5746.css
x-vercel-cache: HIT
x-vercel-id: lhr1::bw7lw-1731953963706-209ba3287e80
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10e0876c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/css/bac459e8b0eec940.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/css/bac459e8b0eec940.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 4630
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="87c73c54-5a48df0e5f90db7f.js"
etag: W/"4990080922551e725dcb5ec8b45b5b4a"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/87c73c54-5a48df0e5f90db7f.js
x-vercel-cache: HIT
x-vercel-id: lhr1::g6mdj-1731953963721-7b3ccfea6346
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f12e3a76c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/css/75023f0f627f7837.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/css/75023f0f627f7837.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/css,*/*;q=0.1
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: style
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="webpack-54393cf863545595.js"
etag: W/"cb475fd1a53c353cb027d5345c5dd122"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/webpack-54393cf863545595.js
x-vercel-cache: HIT
x-vercel-id: lhr1::q6452-1731953963718-9822cd9c2c94
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10dfd76c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/87c73c54-5a48df0e5f90db7f.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/87c73c54-5a48df0e5f90db7f.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="main-app-156bad3c681b2476.js"
etag: W/"69db3bb29b0488953c70d7e0cad263a1"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/main-app-156bad3c681b2476.js
x-vercel-cache: HIT
x-vercel-id: lhr1::k9nxg-1731953963725-377277f40546
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f12e4576c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/855-e6c856b4efad30fc.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/855-e6c856b4efad30fc.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 5652
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="global-error-510fb21d287448b2.js"
etag: W/"41eb95108253306adb9b13b2dffa27ad"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/app/global-error-510fb21d287448b2.js
x-vercel-cache: HIT
x-vercel-id: lhr1::hdmtj-1731953963732-bcf99c61285a
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f13e5c76c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/main-app-156bad3c681b2476.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/main-app-156bad3c681b2476.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 3457
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="855-e6c856b4efad30fc.js"
etag: W/"5363527ce1b645d569b924816b77494c"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/855-e6c856b4efad30fc.js
x-vercel-cache: HIT
x-vercel-id: lhr1::vd5m2-1731953963725-e3a63c133aa4
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f12e4276c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/779-b054475bcf8b3089.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/779-b054475bcf8b3089.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: text/css; charset=utf-8
access-control-allow-origin: *
age: 4207
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="e4af37eb9b9d9fd9.css"
etag: W/"5c4a3d188ce3b2558f3e112187eb1459"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/css/e4af37eb9b9d9fd9.css
x-vercel-cache: HIT
x-vercel-id: lhr1::g6mdj-1731953963709-2fea55c98b1d
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f10dfe76c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/312-e496400ac5174036.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/312-e496400ac5174036.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 5155
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="779-b054475bcf8b3089.js"
etag: W/"140fbc443cb1d5646efd73e426ddc229"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/779-b054475bcf8b3089.js
x-vercel-cache: HIT
x-vercel-id: lhr1::t7ndh-1731953963726-2e97e3e2cad8
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f12e4a76c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/480-2cf23bc5e0b9d2fa.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/480-2cf23bc5e0b9d2fa.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 3107
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="layout-b956fbc4544a1073.js"
etag: W/"d7f1e3ef760b6e4c6d377eec4bfc9b4c"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/app/%5Blocale%5D/layout-b956fbc4544a1073.js
x-vercel-cache: HIT
x-vercel-id: lhr1::fffck-1731953963738-f0752d19fc3c
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f13e6376c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/879-8e5fa64a87415d8b.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/879-8e5fa64a87415d8b.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 1499
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="254-15ce7473777458e9.js"
etag: W/"b46de390a8ab7dc4242ecafa2efc34b2"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/254-15ce7473777458e9.js
x-vercel-cache: HIT
x-vercel-id: lhr1::tb56m-1731953963729-b1e919af8576
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f13e5976c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/254-15ce7473777458e9.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/254-15ce7473777458e9.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="891-0bf8641ab6ae8ec3.js"
etag: W/"d41ea6f89e66b42764fbf80ead4f165c"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/891-0bf8641ab6ae8ec3.js
x-vercel-cache: HIT
x-vercel-id: lhr1::g5w8s-1731953963734-cb80c73d865f
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f13e5a76c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/891-0bf8641ab6ae8ec3.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/891-0bf8641ab6ae8ec3.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 4554
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="175-f4b174441b473dd4.js"
etag: W/"a3eded2824a2c78a9199da395ba1d0b8"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/175-f4b174441b473dd4.js
x-vercel-cache: HIT
x-vercel-id: lhr1::jlxf4-1731953963743-431fde4faec7
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f14e7d76c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/app/global-error-510fb21d287448b2.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/app/global-error-510fb21d287448b2.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 5001
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="page-fc33e6d308c738f6.js"
etag: W/"dd4e6fe0b899e420936ac04e46d654e7"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/app/%5Blocale%5D/page-fc33e6d308c738f6.js
x-vercel-cache: HIT
x-vercel-id: lhr1::2tcrk-1731953963743-4abfe16781cb
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f14e8876c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/app/%5Blocale%5D/layout-b956fbc4544a1073.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/app/%5Blocale%5D/layout-b956fbc4544a1073.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 3180
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="312-e496400ac5174036.js"
etag: W/"c834c308c428d8db482f93958e8d735b"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/312-e496400ac5174036.js
x-vercel-cache: HIT
x-vercel-id: lhr1::q6452-1731953963738-2df7ad4e3c63
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f13e5076c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/70c385e2-9dd9c00e19dd25a9.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/70c385e2-9dd9c00e19dd25a9.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="70c385e2-9dd9c00e19dd25a9.js"
etag: W/"79d456037759467dc7fb0b4c6a49002b"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/70c385e2-9dd9c00e19dd25a9.js
x-vercel-cache: HIT
x-vercel-id: lhr1::jgq9q-1731953963740-cf6254d16b5a
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f14e7076c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/dd62d450-0a720436be3fcce2.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/dd62d450-0a720436be3fcce2.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="87-20be82d1f99e81c6.js"
etag: W/"b92e30d106e39e127d8b7d836a2621bf"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/87-20be82d1f99e81c6.js
x-vercel-cache: HIT
x-vercel-id: lhr1::q6452-1731953963743-a5f8e0ee2ad3
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f14e8176c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/175-f4b174441b473dd4.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/175-f4b174441b473dd4.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 3978
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="879-8e5fa64a87415d8b.js"
etag: W/"e178e6d0d4bee4a3d20cbe0e0f522629"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/879-8e5fa64a87415d8b.js
x-vercel-cache: HIT
x-vercel-id: lhr1::764r7-1731953963733-63408033ecf7
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f13e5376c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/830-f58e3a8610ad077c.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/830-f58e3a8610ad077c.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="480-2cf23bc5e0b9d2fa.js"
etag: W/"3867a29d57d0c3baf636cde34cddf44d"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/480-2cf23bc5e0b9d2fa.js
x-vercel-cache: HIT
x-vercel-id: lhr1::z6249-1731953963738-ae585d61b5ce
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f13e5276c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/87-20be82d1f99e81c6.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/87-20be82d1f99e81c6.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 2640
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="error-89f32912e74842a6.js"
etag: W/"8f8446a966e21727c2ce2ec45460a2ba"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/app/%5Blocale%5D/error-89f32912e74842a6.js
x-vercel-cache: HIT
x-vercel-id: lhr1::2jdg5-1731953963761-d8d517b22838
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f16ec476c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/595-173d422049434268.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/595-173d422049434268.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 3457
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="dd62d450-0a720436be3fcce2.js"
etag: W/"76926091bb90d6d846c25488e6f7caf0"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/dd62d450-0a720436be3fcce2.js
x-vercel-cache: HIT
x-vercel-id: lhr1::g6mdj-1731953963749-fa53366e5fa2
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f14e7976c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/app/%5Blocale%5D/page-fc33e6d308c738f6.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/app/%5Blocale%5D/page-fc33e6d308c738f6.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 6030
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="830-f58e3a8610ad077c.js"
etag: W/"9d5d6822f8fad9769f87514d5e1fcfd0"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/830-f58e3a8610ad077c.js
x-vercel-cache: HIT
x-vercel-id: lhr1::8jp9k-1731953963743-e5b08c608104
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f14e8076c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/app/%5Blocale%5D/error-89f32912e74842a6.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/app/%5Blocale%5D/error-89f32912e74842a6.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 5287
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="not-found-fbba77f6977fc4c1.js"
etag: W/"88282f58b46e57845f912abf6daeb1fb"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/app/%5Blocale%5D/not-found-fbba77f6977fc4c1.js
x-vercel-cache: HIT
x-vercel-id: lhr1::2tw8m-1731953963779-c099e16b6e40
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f18eea76c3-LHR
content-encoding: br
GET

https://nodejs.org/_next/static/chunks/app/%5Blocale%5D/not-found-fbba77f6977fc4c1.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_next/static/chunks/app/%5Blocale%5D/not-found-fbba77f6977fc4c1.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:23 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 1378
cache-control: public,max-age=31536000,immutable
content-disposition: inline; filename="595-173d422049434268.js"
etag: W/"26190e0954fb947459bc5c3d4e0ddbeb"
last-modified: Mon, 18 Nov 2024 16:38:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /_next/static/chunks/595-173d422049434268.js
x-vercel-cache: HIT
x-vercel-id: lhr1::xrgdk-1731953963751-0ba1178ac67a
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f14e8476c3-LHR
content-encoding: br
GET

https://nodejs.org/static/images/favicons/favicon.png

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /static/images/favicons/favicon.png HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: image
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: image/png
content-length: 1370
accept-ranges: bytes
access-control-allow-origin: *
age: 1467
cache-control: public, max-age=0, must-revalidate
content-disposition: inline; filename="favicon.png"
etag: "7eba9689d201a9a27151e45e86032301"
last-modified: Mon, 18 Nov 2024 16:38:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-matched-path: /static/images/favicons/favicon.png
x-vercel-cache: HIT
x-vercel-id: lhr1::9n2tt-1731953965009-3648dbe3cb77
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f93ffa76c3-LHR
GET

https://nodejs.org/_vercel/insights/script.js

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_vercel/insights/script.js HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 18
cache-control: public, max-age=600
content-disposition: inline; filename="script.js"
cross-origin-resource-policy: cross-origin
etag: W/"fcf06e135949a699d8950fec18d1a14a"
last-modified: Mon, 18 Nov 2024 17:25:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-vercel-cache: HIT
x-vercel-id: lhr1:lhr1:lhr1::gxw9z-1731953965055-2858fae2236f
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f9885376c3-LHR
content-encoding: br
GET

https://nodejs.org/en/learn?_rsc=1ijot

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /en/learn?_rsc=1ijot HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%5B%22locale%22%2C%22en%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2Fen%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D%7D%5D
dnt: 1
next-router-prefetch: 1
sec-ch-ua-mobile: ?0
x-deployment-id: dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
next-url: /en
rsc: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 307

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: text/plain
cache-control: public, max-age=0, must-revalidate
location: /en/learn/getting-started/introduction-to-nodejs?_rsc=1ijot
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-vercel-id: lhr1::jgpbw-1731953965090-c588a1347920
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f9b89376c3-LHR
GET

https://nodejs.org/en/about?_rsc=1ijot

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /en/about?_rsc=1ijot HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%5B%22locale%22%2C%22en%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2Fen%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D%7D%5D
dnt: 1
next-router-prefetch: 1
sec-ch-ua-mobile: ?0
x-deployment-id: dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
next-url: /en
rsc: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: text/x-component
age: 293
cache-control: public, max-age=0, must-revalidate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
x-matched-path: /[locale]/[...path].rsc
x-nextjs-prerender: 1
x-nextjs-stale-time: 4294967294
x-vercel-cache: HIT
x-vercel-id: lhr1::iad1::xrgdk-1731953965087-55e0b2f914f3
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f9b89676c3-LHR
GET

https://nodejs.org/en/download?_rsc=1ijot

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /en/download?_rsc=1ijot HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%5B%22locale%22%2C%22en%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2Fen%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D%7D%5D
dnt: 1
next-router-prefetch: 1
sec-ch-ua-mobile: ?0
x-deployment-id: dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
next-url: /en
rsc: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 307

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: text/plain
cache-control: public, max-age=0, must-revalidate
location: /en/download/package-manager?_rsc=1ijot
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-vercel-id: lhr1::nzpl4-1731953965101-49e59eb48a66
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f9c8b676c3-LHR
GET

https://nodejs.org/en/blog?_rsc=1ijot

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /en/blog?_rsc=1ijot HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%5B%22locale%22%2C%22en%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2Fen%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D%7D%5D
dnt: 1
next-router-prefetch: 1
sec-ch-ua-mobile: ?0
x-deployment-id: dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
next-url: /en
rsc: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: text/x-component
age: 286
cache-control: public, max-age=0, must-revalidate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
x-matched-path: /[locale]/[...path].rsc
x-nextjs-prerender: 1
x-nextjs-stale-time: 4294967294
x-vercel-cache: HIT
x-vercel-id: lhr1::iad1::56k4c-1731953965101-6db0a30368dd
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f9c8b876c3-LHR
GET

https://nodejs.org/en/download/package-manager?_rsc=1ijot

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /en/download/package-manager?_rsc=1ijot HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%5B%22locale%22%2C%22en%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2Fen%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D%7D%5D
dnt: 1
next-router-prefetch: 1
sec-ch-ua-mobile: ?0
x-deployment-id: dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
next-url: /en
rsc: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
age: 28
cache-control: public, max-age=600
content-disposition: inline; filename="script.js"
cross-origin-resource-policy: cross-origin
etag: W/"70d60f116be0547cd0a4192c213f2ccb"
last-modified: Mon, 18 Nov 2024 17:25:19 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-vercel-cache: HIT
x-vercel-id: lhr1:lhr1:lhr1::khqtj-1731953965102-756f8bc4a98b
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f9c8bc76c3-LHR
content-encoding: br
GET

https://nodejs.org/_vercel/speed-insights/script.js

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /_vercel/speed-insights/script.js HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: no-cors
sec-fetch-dest: script
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: text/x-component
age: 286
cache-control: public, max-age=0, must-revalidate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
x-matched-path: /[locale]/[...path].rsc
x-nextjs-prerender: 1
x-nextjs-stale-time: 4294967294
x-vercel-cache: HIT
x-vercel-id: lhr1::iad1::jgq9q-1731953965103-a8f81f7e42b0
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f9c8ba76c3-LHR
POST

https://nodejs.org/_vercel/insights/view

msedge.exe

Remote address:

104.20.22.46:443

Request

POST /_vercel/insights/view HTTP/2.0
host: nodejs.org
content-length: 116
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
content-type: application/json
accept: */*
origin: https://nodejs.org
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: text/x-component
age: 290
cache-control: public, max-age=0, must-revalidate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
x-matched-path: /[locale]/[...path].rsc
x-nextjs-prerender: 1
x-nextjs-stale-time: 4294967294
x-vercel-cache: HIT
x-vercel-id: lhr1::iad1::nvrbr-1731953965157-fffaa2dd8551
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7fa292b76c3-LHR
GET

https://nodejs.org/en/learn/getting-started/introduction-to-nodejs?_rsc=1ijot

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /en/learn/getting-started/introduction-to-nodejs?_rsc=1ijot HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%5B%22locale%22%2C%22en%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2Fen%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D%7D%5D
dnt: 1
next-router-prefetch: 1
sec-ch-ua-mobile: ?0
x-deployment-id: dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
next-url: /en
rsc: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: text/plain; charset=utf-8
content-length: 2
cache-control: public, max-age=0, must-revalidate
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-ratelimit-limit: 1000
x-ratelimit-remaining: 999
x-ratelimit-reset: 60
x-vercel-id: lhr1::bwwkt-1731953965120-344231841b41
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7f9e8e376c3-LHR
GET

https://nodejs.org/en/about/previous-releases?_rsc=1ijot

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /en/about/previous-releases?_rsc=1ijot HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%5B%22locale%22%2C%22en%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2Fen%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D%7D%5D
dnt: 1
next-router-prefetch: 1
sec-ch-ua-mobile: ?0
x-deployment-id: dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
next-url: /en
rsc: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: text/x-component
age: 296
cache-control: public, max-age=0, must-revalidate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
x-matched-path: /[locale]/[...path].rsc
x-nextjs-prerender: 1
x-nextjs-stale-time: 4294967294
x-vercel-cache: HIT
x-vercel-id: lhr1::iad1::dmj55-1731953965167-00c0f7e1c960
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7fa393e76c3-LHR
GET

https://nodejs.org/en/download/package-manager?_rsc=1ijot

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /en/download/package-manager?_rsc=1ijot HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
next-router-state-tree: %5B%22%22%2C%7B%22children%22%3A%5B%5B%22locale%22%2C%22en%22%2C%22d%22%5D%2C%7B%22children%22%3A%5B%22__PAGE__%22%2C%7B%7D%2C%22%2Fen%22%2C%22refresh%22%5D%7D%2Cnull%2Cnull%2Ctrue%5D%7D%5D
dnt: 1
next-router-prefetch: 1
sec-ch-ua-mobile: ?0
x-deployment-id: dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
next-url: /en
rsc: 1
accept: */*
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: text/x-component
age: 286
cache-control: public, max-age=0, must-revalidate
content-encoding: gzip
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Router-Segment-Prefetch
x-matched-path: /[locale]/[...path].rsc
x-nextjs-prerender: 1
x-nextjs-stale-time: 4294967294
x-vercel-cache: HIT
x-vercel-id: lhr1::iad1::npbjt-1731953965199-5fd8b0dacf73
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
server: cloudflare
cf-ray: 8e49f7fa696e76c3-LHR
GET

https://nodejs.org/dist/v22.11.0/node-v22.11.0-x64.msi

msedge.exe

Remote address:

104.20.22.46:443

Request

GET /dist/v22.11.0/node-v22.11.0-x64.msi HTTP/2.0
host: nodejs.org
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
referer: https://nodejs.org/en
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: NEXT_LOCALE=en

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:20:03 GMT
content-type: application/x-msi
content-length: 30289920
cf-ray: 8e49f8ea0d0176c3-LHR
cf-cache-status: HIT
accept-ranges: bytes
age: 844
cache-control: public, max-age=3600, s-maxage=14400
etag: "fa9e1f3064a66913362e9bff7097cef5"
last-modified: Tue, 29 Oct 2024 01:59:48 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
accept-range: bytes
x-content-type-options: nosniff
server: cloudflare
DNS

46.22.20.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

46.22.20.104.in-addr.arpa

IN PTR

Response
DNS

72.32.126.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

72.32.126.40.in-addr.arpa

IN PTR

Response
DNS

cloud.orama.run

msedge.exe

Remote address:

8.8.8.8:53

Request

cloud.orama.run

IN A

Response

cloud.orama.run

IN A

172.67.166.61

cloud.orama.run

IN A

104.21.75.8
GET

https://cloud.orama.run/v1/indexes/nodejs-org-prod-vo71di/init?api-key=9A3alsqP5owMUvA4zeHdWrz93yxYZXra

msedge.exe

Remote address:

172.67.166.61:443

Request

GET /v1/indexes/nodejs-org-prod-vo71di/init?api-key=9A3alsqP5owMUvA4zeHdWrz93yxYZXra HTTP/2.0
host: cloud.orama.run
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
dnt: 1
sec-ch-ua-mobile: ?0
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
content-type: application/x-www-form-urlencoded
accept: */*
origin: https://nodejs.org
sec-fetch-site: cross-site
sec-fetch-mode: cors
sec-fetch-dest: empty
referer: https://nodejs.org/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9

Response

HTTP/2.0 200

date: Mon, 18 Nov 2024 18:19:25 GMT
content-type: application/json
access-control-allow-origin: *
access-control-allow-headers: Authorization, Content-Type
access-control-allow-methods: *
access-control-max-age: 604800
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fy%2FDZ6F3ExbcqUATJG3viVmRZU8mhYkbYwCIi8QuUj9DEnE8GGI7B0P9N23SKmBU%2FB4YU2eUtrlqwoA8mwFC5EsnD1A56WEAa2NNGuflZmOYZg9kR945npe2GLfMu%2FyD8iA%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 8e49f7f9a96bb0e9-MAN
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=32901&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2838&recv_bytes=1158&delivery_rate=82628&cwnd=252&unsent_bytes=0&cid=492450dc40216e24&ts=261&x=0"
DNS

61.166.67.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

61.166.67.172.in-addr.arpa

IN PTR

Response
DNS

217.106.137.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.106.137.52.in-addr.arpa

IN PTR

Response
DNS

58.55.71.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.55.71.13.in-addr.arpa

IN PTR

Response
DNS

197.87.175.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

197.87.175.4.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

107.12.20.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

107.12.20.2.in-addr.arpa

IN PTR

Response

107.12.20.2.in-addr.arpa

IN PTR

a2-20-12-107deploystaticakamaitechnologiescom
DNS

3.26.192.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.26.192.23.in-addr.arpa

IN PTR

Response

3.26.192.23.in-addr.arpa

IN PTR

a23-192-26-3deploystaticakamaitechnologiescom
DNS

registry.npmjs.org

node.exe

Remote address:

8.8.8.8:53

Request

registry.npmjs.org

IN A

Response

registry.npmjs.org

IN A

104.16.3.35

registry.npmjs.org

IN A

104.16.24.34

registry.npmjs.org

IN A

104.16.29.34

registry.npmjs.org

IN A

104.16.30.34

registry.npmjs.org

IN A

104.16.31.34

registry.npmjs.org

IN A

104.16.27.34

registry.npmjs.org

IN A

104.16.28.34

registry.npmjs.org

IN A

104.16.25.34

registry.npmjs.org

IN A

104.16.26.34

registry.npmjs.org

IN A

104.16.1.35

registry.npmjs.org

IN A

104.16.2.35

registry.npmjs.org

IN A

104.16.0.35
DNS

35.3.16.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

35.3.16.104.in-addr.arpa

IN PTR

Response
DNS

ip-api.com

Windows Defender.exe

Remote address:

8.8.8.8:53

Request

ip-api.com

IN A

Response

ip-api.com

IN A

208.95.112.1
GET

http://ip-api.com/line/?fields=hosting

cmd.exe

Remote address:

208.95.112.1:80

Request

GET /line/?fields=hosting HTTP/1.1
Host: ip-api.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Mon, 18 Nov 2024 18:21:30 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 6
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
DNS

1.112.95.208.in-addr.arpa

Remote address:

8.8.8.8:53

Request

1.112.95.208.in-addr.arpa

IN PTR

Response

1.112.95.208.in-addr.arpa

IN PTR

ip-apicom
GET

http://ip-api.com/line/?fields=hosting

XClient.exe

Remote address:

208.95.112.1:80

Request

GET /line/?fields=hosting HTTP/1.1
Host: ip-api.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Mon, 18 Nov 2024 18:21:35 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 6
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
GET

http://ip-api.com/line/?fields=hosting

Bootstrapper (1).exe

Remote address:

208.95.112.1:80

Request

GET /line/?fields=hosting HTTP/1.1
Host: ip-api.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Mon, 18 Nov 2024 18:21:36 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 6
Access-Control-Allow-Origin: *
X-Ttl: 60
X-Rl: 44
GET

http://ip-api.com/line/?fields=hosting

Windows Defender.exe

Remote address:

208.95.112.1:80

Request

GET /line/?fields=hosting HTTP/1.1
Host: ip-api.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Mon, 18 Nov 2024 18:21:37 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 6
Access-Control-Allow-Origin: *
X-Ttl: 59
X-Rl: 43
DNS

rentry.co

Windows Defender.exe

Remote address:

8.8.8.8:53

Request

rentry.co

IN A

Response

rentry.co

IN A

104.26.3.16

rentry.co

IN A

172.67.75.40

rentry.co

IN A

104.26.2.16
GET

https://rentry.co/8wum7vax/raw

XClient.exe

Remote address:

104.26.3.16:443

Request

GET /8wum7vax/raw HTTP/1.1
Host: rentry.co
Connection: Keep-Alive

Response

HTTP/1.1 403 Forbidden

Date: Mon, 18 Nov 2024 18:21:45 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 7662
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Content-Options: nosniff
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: iZou68DTsSDuGDUfEKWhbRjxviGcpqDmnpSkdhVKB/CaEmhifwYRzyQItQGJMc0pfFIwYM783uE8WqoYjI/eIyg2gr1Dmz1CARH0+/f8OR2yEdp5QqSj+58VgvM426l5aUst9TJtiTPHz0o8o8x8kQ==$mPWrdYSEzLYyPqi9+fW1tw==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zp5sZCMFP5ugMc6Zg4m2UR3I2vXwnSGQHxbu0Sm%2FUyo6fUQTjvtueT0ei7nFcLKyDHQxGcQIuvBbzDDTnd%2BiOGAWXF1kJiEEPMuf9nPWROQXS2OP90Y79%2FH2sg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e49fb671c7a52b1-LHR
server-timing: cfL4;desc="?proto=TCP&rtt=31256&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2978&recv_bytes=364&delivery_rate=140268&cwnd=244&unsent_bytes=0&cid=2ce5ae0a0566fad2&ts=105&x=0"
GET

https://rentry.co/8wum7vax/raw

Bootstrapper (1).exe

Remote address:

104.26.3.16:443

Request

GET /8wum7vax/raw HTTP/1.1
Host: rentry.co
Connection: Keep-Alive

Response

HTTP/1.1 403 Forbidden

Date: Mon, 18 Nov 2024 18:21:45 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 7662
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Content-Options: nosniff
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: lN1EjXldLb/pHqftuJssW2e9oflE8QZUqR6vy6OBHURSC0mVCAsOLKFjx/23BIJlX5lYLhjCzyRWf0pZKTdEEK6A5rMTgxSgKAshDr22MlH2K8vfIn9mT72a3/PVTo4w5rMiicscdg9WlGo1cYsDkA==$Dr5wbYlaMdcVZ7hDlFfhLg==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T5UShwtUsIjGNATc6vCwiPUmolDhTdvGniuLZ7e2IeCK%2FHsTuvBAzCbvoWcmT%2FqFg8bgLZdE7xhK2xKLZ2rC9nrl7fcxqYLNqPq4eHKLxTPi%2Fw%2FZeqyn3Gbwrg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e49fb6998c58871-LHR
server-timing: cfL4;desc="?proto=TCP&rtt=31574&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2978&recv_bytes=364&delivery_rate=103115&cwnd=250&unsent_bytes=0&cid=3a60bce36006d815&ts=123&x=0"
DNS

16.3.26.104.in-addr.arpa

Remote address:

8.8.8.8:53

Request

16.3.26.104.in-addr.arpa

IN PTR

Response
GET

https://rentry.co/8wum7vax/raw

Windows Defender.exe

Remote address:

104.26.3.16:443

Request

GET /8wum7vax/raw HTTP/1.1
Host: rentry.co
Connection: Keep-Alive

Response

HTTP/1.1 403 Forbidden

Date: Mon, 18 Nov 2024 18:21:46 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 7641
Connection: close
Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
Referrer-Policy: same-origin
X-Content-Options: nosniff
X-Frame-Options: SAMEORIGIN
cf-mitigated: challenge
cf-chl-out: CeppIRn0y5dKgNv6Inb2rZokZCgrRnZvgK8fUkwlL46qdykqK2YjdZljV4Fvgrd4MXP2x6fuVUt2Z1hB9G3vvD4HtBib6IhpGJPWKlNBam4lFo9J9Ua3lJZFwIIEmMInTU8EKK74RveqPORRrLwRQg==$xc3LgPgIk+APbRJDlUDL+Q==
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AutaAdgg%2FO7Qkq%2Fq1z5EcS4oWvOcFKicPjLOOUeFsHA7tWFNxebnGTuApw1zjVHIh8frfcDAuj%2BbuN%2BSwdu3pHhLDNl4WKdbNH27DBXFyWMe4naH2IqmdLZPig%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8e49fb6e0bf26514-LHR
server-timing: cfL4;desc="?proto=TCP&rtt=30305&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2979&recv_bytes=364&delivery_rate=103095&cwnd=253&unsent_bytes=0&cid=60faa8a8d77ed3b7&ts=103&x=0"
DNS

completed-rally.gl.at.ply.gg

XClient.exe

Remote address:

8.8.8.8:53

Request

completed-rally.gl.at.ply.gg

IN A

Response

completed-rally.gl.at.ply.gg

IN A

147.185.221.22

104.20.22.46:80

http://nodejs.org/

http

msedge.exe

764 B
678 B
7
7

HTTP Request

GET http://nodejs.org/

HTTP Response

308
104.20.22.46:80

nodejs.org

msedge.exe

190 B
132 B
4
3
104.20.22.46:443

https://nodejs.org/dist/v22.11.0/node-v22.11.0-x64.msi

tls, http2

msedge.exe

1.1MB
32.2MB
18614
23269

HTTP Request

GET https://nodejs.org/

HTTP Response

307

HTTP Request

GET https://nodejs.org/en

HTTP Response

200

HTTP Request

GET https://nodejs.org/_next/static/media/3478b6abef19b3b3-s.p.woff2

HTTP Request

GET https://nodejs.org/_next/static/media/3d9ea938b6afa941-s.p.woff2

HTTP Request

GET https://nodejs.org/_next/static/media/be2416cbb012c256-s.p.woff2

HTTP Request

GET https://nodejs.org/_next/static/chunks/webpack-54393cf863545595.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/css/e4af37eb9b9d9fd9.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/css/6897a611cf12ddb3.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/css/2458e5048894197c.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/css/b88317ca289c5746.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/css/130b83a7fd77c508.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/css/01b276689d2a382a.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/css/bac459e8b0eec940.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/css/75023f0f627f7837.css?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/87c73c54-5a48df0e5f90db7f.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/855-e6c856b4efad30fc.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/main-app-156bad3c681b2476.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/779-b054475bcf8b3089.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/312-e496400ac5174036.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/480-2cf23bc5e0b9d2fa.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/879-8e5fa64a87415d8b.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/254-15ce7473777458e9.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/891-0bf8641ab6ae8ec3.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/app/global-error-510fb21d287448b2.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/app/%5Blocale%5D/layout-b956fbc4544a1073.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/70c385e2-9dd9c00e19dd25a9.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/dd62d450-0a720436be3fcce2.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/175-f4b174441b473dd4.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/830-f58e3a8610ad077c.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/87-20be82d1f99e81c6.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/595-173d422049434268.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Request

GET https://nodejs.org/_next/static/chunks/app/%5Blocale%5D/page-fc33e6d308c738f6.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://nodejs.org/_next/static/chunks/app/%5Blocale%5D/error-89f32912e74842a6.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://nodejs.org/_next/static/chunks/app/%5Blocale%5D/not-found-fbba77f6977fc4c1.js?dpl=dpl_C9FBqo6uNGBZXu2shVUJWBbFm3HR

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://nodejs.org/static/images/favicons/favicon.png

HTTP Request

GET https://nodejs.org/_vercel/insights/script.js

HTTP Response

200

HTTP Request

GET https://nodejs.org/en/learn?_rsc=1ijot

HTTP Request

GET https://nodejs.org/en/about?_rsc=1ijot

HTTP Request

GET https://nodejs.org/en/download?_rsc=1ijot

HTTP Request

GET https://nodejs.org/en/blog?_rsc=1ijot

HTTP Request

GET https://nodejs.org/en/download/package-manager?_rsc=1ijot

HTTP Request

GET https://nodejs.org/_vercel/speed-insights/script.js

HTTP Response

200

HTTP Request

POST https://nodejs.org/_vercel/insights/view

HTTP Response

307

HTTP Response

200

HTTP Response

307

HTTP Request

GET https://nodejs.org/en/learn/getting-started/introduction-to-nodejs?_rsc=1ijot

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://nodejs.org/en/about/previous-releases?_rsc=1ijot

HTTP Response

200

HTTP Request

GET https://nodejs.org/en/download/package-manager?_rsc=1ijot

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://nodejs.org/dist/v22.11.0/node-v22.11.0-x64.msi

HTTP Response

200
172.67.166.61:443

https://cloud.orama.run/v1/indexes/nodejs-org-prod-vo71di/init?api-key=9A3alsqP5owMUvA4zeHdWrz93yxYZXra

tls, http2

msedge.exe

1.7kB
4.3kB
12
12

HTTP Request

GET https://cloud.orama.run/v1/indexes/nodejs-org-prod-vo71di/init?api-key=9A3alsqP5owMUvA4zeHdWrz93yxYZXra

HTTP Response

200
104.16.3.35:443

registry.npmjs.org

tls

node.exe

11.9kB
424.3kB
206
390
104.16.3.35:443

registry.npmjs.org

tls

node.exe

7.4kB
181.9kB
108
195
104.16.3.35:443

registry.npmjs.org

tls

node.exe

4.7kB
85.8kB
58
95
104.16.3.35:443

registry.npmjs.org

tls

node.exe

3.0kB
42.5kB
36
55
104.16.3.35:443

registry.npmjs.org

tls

node.exe

1.8kB
10.3kB
17
20
104.16.3.35:443

registry.npmjs.org

tls

node.exe

2.0kB
22.8kB
22
30
104.16.3.35:443

registry.npmjs.org

tls

node.exe

1.9kB
14.6kB
20
26
104.16.3.35:443

registry.npmjs.org

tls

node.exe

2.2kB
22.3kB
26
36
104.16.3.35:443

registry.npmjs.org

tls

node.exe

2.7kB
51.3kB
37
53
104.16.3.35:443

registry.npmjs.org

tls

node.exe

3.3kB
104.9kB
51
89
208.95.112.1:80

http://ip-api.com/line/?fields=hosting

http

cmd.exe

310 B
267 B
5
2

HTTP Request

GET http://ip-api.com/line/?fields=hosting

HTTP Response

200
208.95.112.1:80

http://ip-api.com/line/?fields=hosting

http

XClient.exe

264 B
267 B
4
2

HTTP Request

GET http://ip-api.com/line/?fields=hosting

HTTP Response

200
208.95.112.1:80

http://ip-api.com/line/?fields=hosting

http

Bootstrapper (1).exe

264 B
267 B
4
2

HTTP Request

GET http://ip-api.com/line/?fields=hosting

HTTP Response

200
208.95.112.1:80

http://ip-api.com/line/?fields=hosting

http

Windows Defender.exe

264 B
267 B
4
2

HTTP Request

GET http://ip-api.com/line/?fields=hosting

HTTP Response

200
104.26.3.16:443

https://rentry.co/8wum7vax/raw

tls, http

XClient.exe

996 B
13.9kB
14
20

HTTP Request

GET https://rentry.co/8wum7vax/raw

HTTP Response

403
104.26.3.16:443

https://rentry.co/8wum7vax/raw

tls, http

Bootstrapper (1).exe

1.0kB
14.0kB
15
22

HTTP Request

GET https://rentry.co/8wum7vax/raw

HTTP Response

403
104.26.3.16:443

https://rentry.co/8wum7vax/raw

tls, http

Windows Defender.exe

950 B
13.8kB
13
18

HTTP Request

GET https://rentry.co/8wum7vax/raw

HTTP Response

403
147.185.221.22:28996

completed-rally.gl.at.ply.gg

XClient.exe

52 B
1

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

nodejs.org

dns

msedge.exe

56 B
88 B
1
1

DNS Request

nodejs.org

DNS Response

104.20.22.46

104.20.23.46
8.8.8.8:53

209.205.72.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

209.205.72.20.in-addr.arpa
8.8.8.8:53

172.214.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.214.232.199.in-addr.arpa
8.8.8.8:53

46.22.20.104.in-addr.arpa

dns

71 B
133 B
1
1

DNS Request

46.22.20.104.in-addr.arpa
8.8.8.8:53

72.32.126.40.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

72.32.126.40.in-addr.arpa
8.8.8.8:53

cloud.orama.run

dns

msedge.exe

61 B
93 B
1
1

DNS Request

cloud.orama.run

DNS Response

172.67.166.61

104.21.75.8
8.8.8.8:53

61.166.67.172.in-addr.arpa

dns

72 B
134 B
1
1

DNS Request

61.166.67.172.in-addr.arpa
224.0.0.251:5353

523 B
8
8.8.8.8:53

217.106.137.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

217.106.137.52.in-addr.arpa
8.8.8.8:53

58.55.71.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

58.55.71.13.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

197.87.175.4.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

197.87.175.4.in-addr.arpa
8.8.8.8:53

107.12.20.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

107.12.20.2.in-addr.arpa
8.8.8.8:53

3.26.192.23.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

3.26.192.23.in-addr.arpa
8.8.8.8:53

registry.npmjs.org

dns

node.exe

64 B
256 B
1
1

DNS Request

registry.npmjs.org

DNS Response

104.16.3.35

104.16.24.34

104.16.29.34

104.16.30.34

104.16.31.34

104.16.27.34

104.16.28.34

104.16.25.34

104.16.26.34

104.16.1.35

104.16.2.35

104.16.0.35
8.8.8.8:53

35.3.16.104.in-addr.arpa

dns

70 B
132 B
1
1

DNS Request

35.3.16.104.in-addr.arpa
8.8.8.8:53

ip-api.com

dns

Windows Defender.exe

56 B
72 B
1
1

DNS Request

ip-api.com

DNS Response

208.95.112.1
8.8.8.8:53

1.112.95.208.in-addr.arpa

dns

71 B
95 B
1
1

DNS Request

1.112.95.208.in-addr.arpa
8.8.8.8:53

rentry.co

dns

Windows Defender.exe

55 B
103 B
1
1

DNS Request

rentry.co

DNS Response

104.26.3.16

172.67.75.40

104.26.2.16
8.8.8.8:53

16.3.26.104.in-addr.arpa

dns

70 B
132 B
1
1

DNS Request

16.3.26.104.in-addr.arpa
8.8.8.8:53

completed-rally.gl.at.ply.gg

dns

XClient.exe

74 B
90 B
1
1

DNS Request

completed-rally.gl.at.ply.gg

DNS Response

147.185.221.22

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery