Overview

overview

10

Static

static

10

2025-04-11...op.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250410-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/04/2025, 14:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe

  • Size

    42KB

  • MD5

    bea663ba7b6ed934d7e41950010d6c22

  • SHA1

    e01fc5f2dd09784e194fe336334c5b54b76fadbc

  • SHA256

    1418f96bb8de8270e496c2676c5c567ceba03d195f198770352107c73c19fb01

  • SHA512

    b9a5093a1b1078e51176ef31bf88034f0fa0be5f3a97dcb3c59b64e8939b15498adc0f228c68ba084fc6506eabe4c16491e7dacd177ef502909b5f08a61df8b6

  • SSDEEP

    768:ono/YW1wUFGKQI1LSi/TqBKjBg1PuCu7bxGW60596iwL1gw6+fTmIHZDS6/0gTHd:onzW1w1TI1rTEKjBgU9h596I+fTDBSz1

Score
10/10
credential_accessdefense_evasiondiscoveryexecutionimpactransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\scoped_dir4876_957996442\CRX_INSTALL\_locales\am\readme-warning.txt

Ransom Note
Hello my dear friend Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted If you want to restore them, install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market ICQ Write to our ICQ @Lookfornewitguy https://icq.im/Lookfornewitguy Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. As early you write us - then lower will be price We give all guarantees of your files decryption
URLs

https://icq.com/windows/

https://icq.im/Lookfornewitguy

Signatures

  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (9365) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 20 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4952
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:3712
      • C:\Windows\system32\wbadmin.exe
        wbadmin delete catalog -quiet
        3⤵
        • Deletes backup catalog
        PID:3892
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5076
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5496
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5176
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2824
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2644
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5556
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2364
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3160
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4804
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2156
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5260
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3792
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1416
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1832
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4848
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1600
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1760
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4108
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1960
    • C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\readme-warning.txt
      2⤵
        PID:4376
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4396
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:740
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:3580
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:1016

      Network

      • flag-us
        DNS
        iplogger.org
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        8.8.8.8:53
        Request
        iplogger.org
        IN A
        Response
        iplogger.org
        IN A
        104.26.2.46
        iplogger.org
        IN A
        104.26.3.46
        iplogger.org
        IN A
        172.67.74.161
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;2.92
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:53:58 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb51070e614916-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb51070e614916"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: Q8rCntsK9HnuKRIXfycQ5yZVedFe5HBv0vLFdNRe7kRxgwHU7A/Bhlk78XiDRREM9fOBsHYiA9JGXjRsezVpwQZ62JI9URuisPXVjdMWuPWqvUb/ZvJP2f9Lzw9iKsuO4Z/+Wi//IKrlj2J+edcehA==$a/b5dJwsozK4JO9+mavE2g==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bX1x6XpnnPeN6DMSEOLMeFq0ZPTCuYT7aP1TDpku4Mly77LFNIavyZ9J70jQrIcNDuZkad2KW6nPo5WeOBokaVD3IYas70Pr6s%2FF8eAcZ%2F6hE3303JmMRFxEzg5QKEU%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47091&min_rtt=46797&rtt_var=7705&sent=5&recv=9&lost=0&retrans=0&sent_bytes=3282&recv_bytes=394&delivery_rate=83959&cwnd=252&unsent_bytes=0&cid=99180018f898f1dc&ts=467&x=0"
      • flag-us
        DNS
        c.pki.goog
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        8.8.8.8:53
        Request
        c.pki.goog
        IN A
        Response
        c.pki.goog
        IN CNAME
        pki-goog.l.google.com
        pki-goog.l.google.com
        IN A
        142.250.179.227
      • flag-gb
        GET
        http://c.pki.goog/r/gsr1.crl
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        142.250.179.227:80
        Request
        GET /r/gsr1.crl HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/10.0
        Host: c.pki.goog
        Response
        HTTP/1.1 200 OK
        Accept-Ranges: bytes
        Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
        Cross-Origin-Resource-Policy: cross-origin
        Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
        Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
        Content-Length: 1739
        X-Content-Type-Options: nosniff
        Server: sffe
        X-XSS-Protection: 0
        Date: Fri, 11 Apr 2025 14:36:53 GMT
        Expires: Fri, 11 Apr 2025 15:26:53 GMT
        Cache-Control: public, max-age=3000
        Age: 1024
        Last-Modified: Mon, 07 Apr 2025 13:58:00 GMT
        Content-Type: application/pkix-crl
        Vary: Accept-Encoding
      • flag-gb
        GET
        http://c.pki.goog/r/r4.crl
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        142.250.179.227:80
        Request
        GET /r/r4.crl HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/10.0
        Host: c.pki.goog
        Response
        HTTP/1.1 200 OK
        Accept-Ranges: bytes
        Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
        Cross-Origin-Resource-Policy: cross-origin
        Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
        Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
        Content-Length: 530
        X-Content-Type-Options: nosniff
        Server: sffe
        X-XSS-Protection: 0
        Date: Fri, 11 Apr 2025 14:36:57 GMT
        Expires: Fri, 11 Apr 2025 15:26:57 GMT
        Cache-Control: public, max-age=3000
        Age: 1021
        Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT
        Content-Type: application/pkix-crl
        Vary: Accept-Encoding
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:54:00 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb5113bdad634c-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb5113bdad634c"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: ic7NZ6KplupRF7MG/hvuNJUYkkl+o5BkGG8ryfYIY62JZO4ep9o+79oL+s+fMWcoSwVMc0qXs+sKA0XZqMX/YTGEZ0GJHiCdTPIGJpq2+izAPmNdtIs+HuR8ThoOMyxTrh0HfHPAN1Sbr4uZTTgpPg==$KVZMtNgXyfCKQr1p1c36jg==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kQO5fMECr0dsF9mKYGhDna%2FlleT98seURjrMID8Y6tI%2BXkT18CqSV%2FflU0tG1YR7l%2FuEqUTIkN7a2pml3QYIW0WunqBBPas4afkfeV3gtFFziEK4fA0h7ZnaAikBXzc%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=46936&min_rtt=46914&rtt_var=17638&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28239&cwnd=249&unsent_bytes=0&cid=95da1e8026373871&ts=70&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:54:06 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb513c585794ba-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb513c585794ba"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: pW36vCQapkGu5JiQ4HIiMtLtN9sYqO0BEr+fXjhCxwN7WluWVpUnubnYJmq7Vxnv04C3WNmh2kMRvj97AYETnNCuBNYBmj8cDclsS1dvh6NeSVuYJBaijKmSzT81r89MmQ/t8Ayg/IDy/LFSu7XFvg==$tZhJp6ILGq8DspZ2xnOXUQ==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=08qouyxK7qJ0RugQMz50FuDqE4Rly3Kd%2Bmj1POzwge1ecp4sp9cc49ysrWHKv0OwOg%2FMrpN5OxHh1p1o5P%2FV5SX2Cd1k4Ss0g7l5r6cccGqBCbycvgzoebqnm1%2Bt7s8%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47362&min_rtt=47172&rtt_var=18069&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=27314&cwnd=216&unsent_bytes=0&cid=efd89b6235d8ae70&ts=79&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:54:13 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb5164da0fcdba-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb5164da0fcdba"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: ZEwdO7nNCcKCJ/DYc2tyYTFM5uyFVWHMX7GW3bOak8Ymlq+O6P1YLe7i+iWxTfIQ8lvdG7RfIsD/yIQaiWVwkJ6Klm4LoLR14WNYBklhrzWiFZdANv+xgCkdMrBR1jTiv11sCfOz1ntlJlaPy3hiiQ==$Rk6wvQnqKMRVYhbeETVF8w==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ma6HNKNaa8kQrNWNm8MJI1VAmQoL6XbAWNa5nXGVfi6SThi0HEk4qm7NtXUOcmDCt%2BWxviFlmFKtAQ8ZQs9Ks5NWgHhmWc4vRxyt7srHuTjKWFal7Im3kDTq7RjdJMY%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47060&min_rtt=47041&rtt_var=17678&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28181&cwnd=224&unsent_bytes=0&cid=0f1be9a74ceaae88&ts=88&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:54:19 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb518d9cd01b03-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb518d9cd01b03"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: u4ksMPWBf2fIBM8Mfi634WbatR33uW36E6ExlkuGU3UMUYUFO4az3TAYjRd946WwEJC4ivJ5KxnkBfM6s8o32XAj1GNwo/zRDJgfsWjRr6uyMtds6Difj84zUdQdXMdsmUd3x9sY3uN9k5fuRTMg6A==$PSO7dNqizy3GgnObq2DTkg==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c%2B2BWCtLJG0ilwi9O4Vyq3Xzc8GHE%2FHJafhNnBETmPUSL3T8R3L81gSDuAxLQGUw3ZmXL9aIQ6GfxScxzOk5zMxaOUpGhAnQWWCzbzkuoDNanXzj7RU6Q7K%2Bu%2FJgLyo%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47185&min_rtt=47000&rtt_var=17757&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28297&cwnd=250&unsent_bytes=0&cid=b3a609d6034c9f64&ts=66&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:54:26 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb51b6d9e1417c-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb51b6d9e1417c"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: LMjz2HCa2GISeZfc+JeV2MVzlHuKxfwpt7cAKORMGXhLsihGXizE+h7gYM/x/FLGZYf/JzMuGQuQ3QITauMTevGrkxjpObgl4EmF2qAZwTczRWlUaIF9krzMHSpj4icpnllgRfWnr7qdmhs24pTeuA==$oDez/I5stffl6bhr93lKlg==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mKAjG74eQhy6vyjRBY6E1gni2sjkgtGGddtEhZvgktp3Pn0AfiMAgMK9FYbX%2BaDw3oIDNSAZLFK7%2BEmpNkubtBLDRrSTvIEPoRTQ%2FF7NdmzSd0ovSiP3uPUNcquUnJw%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47426&min_rtt=47096&rtt_var=17897&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28240&cwnd=242&unsent_bytes=0&cid=73a418ea11d0c9be&ts=69&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:54:33 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb51e20f477a3e-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb51e20f477a3e"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: SAbVSAQ8OF3dQvEf5YXeAzvbbNSjyZUoKabTmcTHPoAQmDBgtzzziLSJZYBH5VPZfYLBIP712yfKC4N5a32FWBgjqR8Wi7bejWp4M1pLuyR9duJor9hGl2zUzUemSIqVBJeXccECY+HqVPmX5Wzo2A==$Ruxhef61SK6eTbftvJb/Tw==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nGflSDx3Z3C9s6CTLF1I6UwuUBVlmGOmH%2FJXgJk9tAQLA3mmGhFIHdjqwqfbu%2FvvwYalfO7174ZYgyDqQP%2BOHM7YngW22zy%2F974p0P0Gx5tFqoaiHlC2Ja1o4iX8CaI%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=46991&min_rtt=46938&rtt_var=17707&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28081&cwnd=231&unsent_bytes=0&cid=e261c738eaaf0f2a&ts=67&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:54:39 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb52090b61cd54-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb52090b61cd54"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: rjuWHUm5gKLiNYveDAexhcXbtqBOS5g44xi/vjNR6FqQtYRpzHC8Q8hC0JwIlnZ6N2XzwNvIdR4TGJ2/ET+9ern+uW2xSdxIm7P/hlztjKE0kFgoJoavY8k1hSl5kiwUzYZZO1ApFFJEcULVctRyhQ==$Hdmpk2To/S2n/BPSL5kZ1A==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mf%2Btp6blF%2BX2oVMHBqgfaVGn6%2BRPAIYHhaZJkwIVdSkO0t3%2B6N6n7lYYxKVWWkq1mPoRyuJtGM4fFTVcPq1Z9BIOpS8Y5tutXsll2uAUUVSN%2F3ntmvo6RhTEWpIcgVM%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47084&min_rtt=46984&rtt_var=17691&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28307&cwnd=250&unsent_bytes=0&cid=11feeb7dbf3e8482&ts=66&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:54:46 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb52356b32cd1a-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb52356b32cd1a"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: r1ImE/fgjm0tMc6tyFq4g+o3WOJnImXm/PEyASuwz4ZgDYUgKMECUO58rUD+RXa6txxA8tLwLHaIqyy3WBGiETek7CuIaYk/hYHrv9tcYWeku7J7mUpW/Yzv22V5cMzo/kw0joPmd+6yavzCO4tHUQ==$7fKFy2J9wPT4lwstChssbg==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BEEYEh3k0c7mTrU5HZi2wRmCish58%2FXp7DPK7jw1RotW6XebURLvu6dOAQozs222PqEAKyWkMq%2By8kzaFT9yeW9QNPJl3lv%2FwfETb7oC6igfq%2BprYMMo95XJev0vVuQ%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=52235&min_rtt=47255&rtt_var=21278&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28145&cwnd=243&unsent_bytes=0&cid=89140ce5c90d11b2&ts=71&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:54:53 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb52605a83631d-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb52605a83631d"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: KL5S9moBhVqKuYaXixE7z7/HvUu6bmnuPFAEgAqdIPZd2Fj6OPEnY1unu4BOdsvScBov7qak7MQkaFGKIcS8rgPVW9NwYB+1vPc3zE8zgGd46pC2v/78tO3Jw7IHwf4VUUBk2+4bDjnKtT5Hy8X0Xw==$YEMWuRGGxj7pmjUFx5skfw==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qX4klsa3tDxXl8pJEgBmSqUi9zcF9e3OArqm7kKpkfXQfOt4jLSxnHVoL%2FDrRT9%2FtFSaDsKEAuoMoJ4lWr%2FV35ULUTw0qvl5EUAzyF25scMWyzNEVkMdE23WKh2PgWQ%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=53258&min_rtt=47452&rtt_var=29407&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=14163&cwnd=248&unsent_bytes=0&cid=47541febb8f064f5&ts=127&x=0"
      • flag-gb
        GET
        http://c.pki.goog/r/r1.crl
        Remote address:
        142.250.179.227:80
        Request
        GET /r/r1.crl HTTP/1.1
        Cache-Control: max-age = 3000
        Connection: Keep-Alive
        Accept: */*
        If-Modified-Since: Thu, 03 Apr 2025 14:18:00 GMT
        User-Agent: Microsoft-CryptoAPI/10.0
        Host: c.pki.goog
        Response
        HTTP/1.1 304 Not Modified
        Date: Fri, 11 Apr 2025 14:53:55 GMT
        Expires: Fri, 11 Apr 2025 15:43:55 GMT
        Age: 60
        Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT
        Cache-Control: public, max-age=3000
        Vary: Accept-Encoding
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:55:00 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb528dcc2ffc2b-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb528dcc2ffc2b"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: cR9vb8GVZPY60EvbjvVlJL5KMygdSTLJ3s8Qut80FF0PVscnrMhlBGgt+mxUZm/EogD3bFqHRrjgOYGAgyKqium+qi3lF3spCAjaXo0++QS41Yf0IPL6zPUXooiWpWsqTWb/pbQPnGsfIZhCpVK5Pg==$/V5QIKy2IoWkbExxWX2Z2Q==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7qgY4hcB%2BXfjfAjBMxJ1rXgcdBS4cAu680LhOXiPCwrLqIYb%2Fvz4CBMKiYXzukKMbZiYZX71oVbMJdRb1ZxmBniUQSD2k%2Biy6R4e9qNbEMoc%2BsLLos80xEH%2Byq8G6t8%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47235&min_rtt=47235&rtt_var=23617&sent=3&recv=6&lost=0&retrans=1&sent_bytes=115&recv_bytes=544&delivery_rate=28157&cwnd=250&unsent_bytes=0&cid=9849a08627124df3&ts=71&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:55:06 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb52af9daacd4b-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb52af9daacd4b"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: ySfmkRtFbsNinK0FyrckkqoDcPHe4o5rOCkiN6YYeTf0IkEqQ5HFt8Tn9LCndXtLl8YcL8UVAPcScJm4GiDcJi88MdzR6qjPyyAWgOJ8yZA17vkgVRleqUB4aB6BLVtnWmCbLxv7WxVuzBdPNKYvmg==$ZI32Gpi67e9Th1KEbHRTCQ==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0eA%2F9%2Flkg3EwqrDLPk%2FU%2FEJYnCQYqKXLcv81Ao9Ym2UFexd0REWoda5U9q9AoIQVM%2BRsGLVHh6qqzAdNvoL9%2FhpsQ2wsuB%2FbY2AK4kOFIbdyEyLJjzr2nrN8%2BobfXTc%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47672&min_rtt=47303&rtt_var=18477&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=26464&cwnd=250&unsent_bytes=0&cid=ce3ad183cecf8f38&ts=71&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:55:12 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb52d9cb06dc2c-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb52d9cb06dc2c"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: JyQQ7Rpa1q8R+Z8QxOcE2UI4RGWaf3Jg96Wmt2spTSN/x2Qtip/GXd5ZhOQ5lTlGu0iV/xC/yKg0+ipn6EdlRYQLiybnRZT0P5X4ZNHXAneYnUjlLdMqSbvJT0KvXWGFuHT8CUYb+yxPC+8Z7g2pLQ==$wdzL44QmefpSNSxoIlFlnA==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ytJPI0eozJe%2BJ6WP%2FOwxQY%2BLSqXOvEbqJmAcnRSCPmHnm2SQWDls5yZ0qxUraU19m%2BQEhDjNXOSmqIlIETXWbu0aYwC0cH%2BtezxMYXB0JniJb0ymljOqCP0%2FiCyCcSQ%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47410&min_rtt=47323&rtt_var=17808&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28104&cwnd=250&unsent_bytes=0&cid=6faa16bec7c2366a&ts=66&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:55:19 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb53031d7f8168-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb53031d7f8168"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: ni9QAaYtMzDP8TD7T/wJrWv2If/3RAyKW/4/C+xEJO+uS7OAdKwzQnHsZwI1h5Wr/5Q+oy/0tOSSdbXzwHRrQw0e5f29I3En7G7Ol+s5DZL2yW+ZnYFCmajQ3iw9G9z6RuvYoB0OUSISHt1flKXb8g==$1QhFA8QacA3gudrMzYnd3w==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZfpXYjSvRXEG%2BhFtsx1a4dGZZY5D7cYWNQAMSQLDk7dqxfTrA%2FvWNz%2BELnLbev%2F9t%2FzCHwGbSo19bpav%2B959q8Sphk59DNLa%2FaLoAxG%2BL8XOk4qGoE11Ol3KBqrDa%2FY%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47349&min_rtt=47137&rtt_var=17828&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28215&cwnd=250&unsent_bytes=0&cid=22b7ea499ab335e7&ts=69&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:55:25 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb532a79b738a1-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb532a79b738a1"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: +aqk5+j8uqF2uMYCFTJy+CdSNRI2eMNh1HjJexkoP0qoFAWPW9/mkVqgEhpacgz4qpEMySMknkacibKMuQPFIeoMVFLZnUN69OP9twB0S3kwdvwL4CVoGpPsMlHwtQdR3jhIZEGl7hi+jIzJe79Gtg==$BeHnWa/+FgHR60n3gOxhWg==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cn3cqcRnKu2b8hUMhzfngorMakzhUAE2EnnFJ%2FHwRJDWRMKlzaSTVZzPaYApWA2Cq0enJArRNs8WV%2B6M5XaRghpkBk1eTHeTDOpgy69SwFWIyVlNj4zRg%2FgbjlDf%2BsU%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=46972&min_rtt=46960&rtt_var=17634&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28262&cwnd=250&unsent_bytes=0&cid=7fe8c28ac933deb0&ts=61&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:55:32 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb53555fb34197-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb53555fb34197"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: tAJXsqhpyWBpyD0p4jaStsSo2nB91+zMDX78CUdBLEmObTl+FCrmU1UAV6vNUzSIWVL4+a1TyjD4PBKgg4pepOrNFhj1vXeh/LOXxu8vH/wyDzGbSJxCj4WYE2dttUTcmox6hhk+c2/Cx1xp9D8zFw==$0nUQbCB3oLBhI95uZsT7bg==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aOp2%2FoshZZUW3Wt18n1BazW7YenkQzhltQ7rw%2BxcFinMSYu1%2BhqESPE0JiKu3yvNsoXwBGb0AEw7n7oKfl54KOKn8qjV1j1A4r5Dkyb%2B7x%2FNkuKxySyaruiHfxA4zZQ%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47396&min_rtt=47317&rtt_var=17800&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28108&cwnd=250&unsent_bytes=0&cid=3247124d0bcc3d61&ts=68&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:55:39 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb537ddd5ee839-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb537ddd5ee839"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: Co2+zOW0MOGvOe9GibAvwFFiZszSG3EdBugT9bqAouX3FfFoTvgdDW5Kjj3kr+GF0ZA0N7z9tbiPyg9nrk49GQU5E9hVosgAOMDJrDbsPa6D6S9JTf471DI/zS5n6a4KT5KDM+/hrz3JPgbXUGsh7Q==$WEKku30AmgF0liUvANkLHg==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o69aPw4O38KaYLZpsXvzN7oKsWeLBHz4T7GKVaFnlTt1go7jHgvfNUaEatpodjQsuv%2F%2B%2FkNDiwNa2ZTZGeonP6kg1%2F8Ud%2BySP29VHKerG%2FOSrVOEYkGHMUr4u%2B68o%2BE%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47460&min_rtt=47163&rtt_var=17898&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28200&cwnd=224&unsent_bytes=0&cid=15c1af8b14163e70&ts=66&x=0"
      • flag-us
        GET
        https://iplogger.org/1sk9s7
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        Remote address:
        104.26.2.46:443
        Request
        GET /1sk9s7 HTTP/1.1
        Referer: DFA7C041;0.00
        Host: iplogger.org
        Cache-Control: no-cache
        Response
        HTTP/1.1 403 Forbidden
        Date: Fri, 11 Apr 2025 14:55:45 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: close
        Cf-Ray: 92eb53a6afb16552-LHR
        Server: cloudflare
        Accept-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cf-Mitigated: challenge
        Critical-Ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
        Cross-Origin-Embedder-Policy: require-corp
        Cross-Origin-Opener-Policy: same-origin
        Cross-Origin-Resource-Policy: same-origin
        Origin-Agent-Cluster: ?1
        Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
        Referrer-Policy: same-origin
        Server-Timing: chlray;desc="92eb53a6afb16552"
        X-Content-Options: nosniff
        X-Frame-Options: SAMEORIGIN
        Cf-Chl-Out: RKb5aP3GTWgiKV0IS0mVIueHTbaDc0XJKacQoVoq1KHIejTJcaEOzcxaYiOZwAwefj2RKvc1V59FPnlLNQe+rN3/LoWXWkuFkFivHgK8w7agNi9ovIh+QWofP2hFEfZjfIW6X7JwPXJGIE2UIKeD/w==$gVLvO+tlOHUTkfedYKs82A==
        Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Xv4MdAJhOmDeYLLkq%2BP3zDdwIoqR0e9%2B0%2FE5%2FSPMkORDFHtNP7MpKutrGCbOnV9oATvoHauC%2FsTYDHZosFp7xMsIlnnvwjgA5NJ6Ifg3RDOFJ7htV0OcFXRqZCA8Ao%3D"}],"group":"cf-nel","max_age":604800}
        Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=47256&min_rtt=47226&rtt_var=17770&sent=3&recv=6&lost=0&retrans=0&sent_bytes=115&recv_bytes=544&delivery_rate=28018&cwnd=248&unsent_bytes=0&cid=6f821be0d22a460a&ts=75&x=0"
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.3kB
         13.2kB
         21
        18

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 142.250.179.227:80
        http://c.pki.goog/r/r4.crl
        http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        602 B
         3.9kB
         8
        6

        HTTP Request

        GET http://c.pki.goog/r/gsr1.crl

        HTTP Response

        200

        HTTP Request

        GET http://c.pki.goog/r/r4.crl

        HTTP Response

        200
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.2kB
         20
        16

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.3kB
         21
        17

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.3kB
         21
        17

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.6kB
         10.4kB
         23
        19

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.4kB
         10.2kB
         19
        15

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.2kB
         20
        16

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.2kB
         20
        16

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.2kB
         21
        17

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.4kB
         10.2kB
         19
        15

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 142.250.179.227:80
        http://c.pki.goog/r/r1.crl
        http
        436 B
         353 B
         5
        3

        HTTP Request

        GET http://c.pki.goog/r/r1.crl

        HTTP Response

        304
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.3kB
         21
        16

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.4kB
         10.2kB
         18
        16

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.3kB
         21
        17

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.3kB
         20
        16

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.3kB
         21
        17

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.3kB
         10.2kB
         17
        15

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.3kB
         20
        17

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        https://iplogger.org/1sk9s7
        tls, http
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        1.5kB
         10.4kB
         22
        19

        HTTP Request

        GET https://iplogger.org/1sk9s7

        HTTP Response

        403
      • 104.26.2.46:443
        iplogger.org
        tls
        1.5kB
         10.2kB
         20
        16
      • 8.8.8.8:53
        iplogger.org
        dns
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        58 B
         106 B
         1
        1

        DNS Request

        iplogger.org

        DNS Response

        104.26.2.46
        104.26.3.46
        172.67.74.161

      • 8.8.8.8:53
        c.pki.goog
        dns
        2025-04-11_bea663ba7b6ed934d7e41950010d6c22_elex_makop.exe
        56 B
         107 B
         1
        1

        DNS Request

        c.pki.goog

        DNS Response

        142.250.179.227

      MITRE ATT&CK Enterprise v16

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      Windows Management Instrumentation

      1
      T1047

      Persistence

      Privilege Escalation

      Defense Evasion

      Direct Volume Access

      1
      T1006

      Indicator Removal

      3
      T1070

      File Deletion

      3
      T1070.004

      Credential Access

      Credentials from Password Stores

      2
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Windows Credential Manager

      1
      T1555.004

      Unsecured Credentials

      1
      T1552

      Credentials In Files

      1
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Peripheral Device Discovery

      2
      T1120

      Query Registry

      3
      T1012

      System Information Discovery

      3
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      1
      T1005

      Command and Control

      Web Service

      1
      T1102

      Exfiltration

      Impact

      Inhibit System Recovery

      3
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\scoped_dir4876_957996442\CRX_INSTALL\_locales\am\readme-warning.txt
        Filesize

        588B

        MD5

        6ea94c7771c90caa1622897571e1f1bf

        SHA1

        02892cd85d27e197ac3ad50252c997683491a82d

        SHA256

        f42c5bb7fce5b4d0af8a08bf4d0d0c183f7158bfd7561d639e398b3b3e02d3dd

        SHA512

        474e26492aa91036931afaef1f826c02069feee0dc52427a784941fa674fcd68f0a46820b3a9fbfd29a529f128d286a45e8439452de565a3dcedd284d5644094

        Download Submit

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.