Edit tour

Windows Analysis Report
https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z

Overview

General Information

Sample URL:	https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z
Analysis ID:	1613262
Infos:

Detection

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious Javascript

Detected suspicious crossdomain redirect

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6148 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1828,i,10876008150740969365,11341645373394169404,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6428 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

• AV Detection
• Phishing
• Networking
• System Summary
• Boot Survival

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=a3db7cd464228025d120ca597c81b5f2	Avira URL Cloud: Label: phishing
Source: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=-7	Avira URL Cloud: Label: phishing
Source: https://pephytriastared.com/landers/vpn_prop_orange_c/en/jquery.min.js	Avira URL Cloud: Label: malware
Source: https://pephytriastared.com/favicon.ico	Avira URL Cloud: Label: malware
Source: http://dyetui.com/js/fingerprint/iife.min.js	Avira URL Cloud: Label: phishing
Source: http://dyetui.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: http://dyetui.com/f2.php?e=0lX5WLfdaRDGjHQWNbafGn49flhRK1NpcGp0S0MrYkV0cFJNd0pVd2tpTFJJZ0JjLytMcFNoMVFTTEpjTDF1ajNxTnlHdnMyL0s2d0lEa1pCRncrWnZtVUk4U1lOdmdTZllYNGw1ZWU0bXg0YVd2dG43clJ5Y3lVK2JaTGxaV2ZRVnY5VmxRT29qWnF0RUNWYzhOelg5Z3pncjdVbjhPOXUvNUczODdtWUxxSU5hNE9pS2JPQkZDUjVvbDVFUGNhZmVhaVBIUzdDV2RsL3BlR1JrazE2WG5mMFp4UXZ0SEw4dEx6c1A5M3Z1czBUVUt0K3c3N3czNHBYaUtpMGZtYUZocjU5N05iek9oaUthSnZsMWtsaDZIbjJFanJMSlBYTG5KRlJRRktuTjkraWJNT0VtQVo5VTdWc3lvcFQ3b2tqc3dLSGpvZkdKU3R3Q2xLRmVJNzUrbUpDaEVnZHdvZndiSFZhYlZNbStETEZpeWpDbHMyTEJQWVI2K3FscmllN0xudERWUFptUDdDbnYrR1dTcThYbmFNU0NGZWd4N29PMUJwcVpmT1hQV016ZGRiN0RjczdITkpPNVZGOWZvbUVDMmU1SWdIZ28wZXlnMXRDVlpCalY2a1haQy9CdGFjbXV6T2d0VnZDZTZjdW0rVHdKMVJrN0Q2SWdzZThSY3BmdFBDVVFDYTVFNHhWaGN1Ty9QbFYxaTRSdFZQL3Z1ZnhVWHJrdGZacEFBT1AvMmRzNWhuQ0hlcEM4VW1yUT0%3D&vs=1280:907&ds=1280:1024&sl=0:0&os=f&nos=f	Avira URL Cloud: Label: phishing
Source: https://pephytriastared.com/landers/vpn_prop_orange_c/en/aff_i	Avira URL Cloud: Label: malware
Source: https://pephytriastared.com/landers/vpn_prop_orange_c/en/dl.min.js.html	Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 0.3.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and redirecting the user to a suspicious domain. The use of obfuscated URLs and the collection of sensitive user data (screen size, window size, and screen position) further increase the risk. Overall, this script demonstrates malicious intent and poses a significant threat to the user's security and privacy.
Source: 0.1.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated URLs. The script attempts to redirect the user to a suspicious domain ('http://dyetui.com/f.php') and includes a fallback mechanism that could be used to bypass security measures. Additionally, the script collects the user's fingerprint data and appends it to the redirect URL, which could be used for tracking or other malicious purposes. Overall, the combination of these behaviors indicates a high-risk script that should be further investigated.
Source: 0.5.id.script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://pephytriastared.com/click.php?key=s6o47ljy... This script exhibits several high-risk behaviors, including data exfiltration and the use of obfuscated URLs. The script sets the 'src' attribute of an element with the ID 'dload' to a URL that appears to be a tracking or affiliate link, which could be used to collect sensitive user data or redirect the user to a malicious site. The URL contains multiple parameters that are likely used for tracking and analytics purposes, and the URL itself is heavily obfuscated, making it difficult to determine its true purpose. Additionally, the script uses a setTimeout function to delay the execution of this behavior, which could be an attempt to bypass security measures. Overall, the combination of data exfiltration, obfuscated URLs, and delayed execution suggests a high-risk script that should be further investigated.

Source: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy	HTTP Parser: No favicon
Source: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5	HTTP Parser: No favicon

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: ddossecrets.com to http://dyetui.com/f.php?e=4yjh2gyg8yctcixqjazdjn49fjr0wnrpdxvdmgrhn1htchj0bst2wmhgq3ronwvralzdymr5zfrmvevsmlj1bdjaa1podgvfnxbmmvlrclkzclj6bgheruxswxzwr0n2uysvejb6ru1ievfoug1eumqrsw1ssldpbg5xwed2z1ncqvkxnu9stxk2rkrute8ryvixl2r6zflyuff4elmym0vktmnadfjiuwpkwtfsuwpjzzrsewlmamtqqwjsrxcyrfc5surwz2gxmtyvqllxzmvsugpqdu44c2xznwfpzm1ac1a3cjhkrwlvci8vbjnvuusvdnhletfwuknsddl1bwxketdtywlytm5kelfct1rezkj6mnl3ckf2efnszejqvupxqnavsew1vkeyenfswul5ade1evqwynvwvkk3duj4k09hnmhxamxmzfflz2jsa0j1zhnyuflktjlzbg9brmrjvedpq3dtrwxebmnkc1f3tkdvt040wkfvtdbxctfosfb6sw1fq0hlngm3y3m2ttnktu1iuwjnynloeupnvwlrselmagfjrzc4dtzutwxtbfllmwjankr6m1bdzzjmunhidhm1vjfcqwdwenducfvjagjluetutwdyofrxk0lievvvwlntcw55mjzvwjfyt0q2ow1abdnonzu5zzlsq3h3d2tkztnvetjuewxasjhyl2cy

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.77.188
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.32.138
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.106.160
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.106.160
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.106.160
Source: unknown	TCP traffic detected without corresponding DNS query: 2.19.106.160
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 12 Feb 2025 15:34:27 GMTserver: Apachevary: Accept-Encodingcontent-encoding: gzipcontent-length: 1203content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 57 5b 73 da 38 18 7d 4e 66 f2 1f 34 74 66 21 d3 2d d8 e6 b2 4d 02 d9 69 02 22 31 b1 53 7c 05 bf ec 18 49 c6 17 f9 52 5b 80 4d 27 ff bd 32 90 76 bb fb b0 fb dc 89 5f 6c 49 e7 48 df 91 e7 1c d9 43 9f c5 f4 f6 e2 7c e8 13 17 d7 77 16 30 4a 6e 31 4e 8b 82 a0 9c b0 a2 8d d2 78 d8 39 76 f3 f1 02 e5 41 c6 00 ab 32 32 6a 30 52 b2 4e e8 6e dd 63 6f 03 14 39 1a 35 3a 61 d1 f1 82 64 4d f2 2c 0f 12 d6 09 02 8f b4 e3 20 69 87 45 e3 76 d8 39 62 ff 73 2e 0e d8 ba 39 c8 09 0e 72 82 d8 5f 34 48 22 30 02 4d 9f b1 ec ba d3 c1 15 61 9b a0 2e ae e3 b5 33 3f fb 93 8c 7a cb f0 41 5a 57 d3 8f 15 62 f7 41 39 97 3f 39 63 39 e9 5d 79 a1 26 d8 89 96 e1 85 35 56 a6 da 83 2a fa 0c 3d c8 c2 4a 67 92 1d fb d3 79 57 4b 55 db ca 5d ea 8c 97 b1 d6 77 a0 a6 58 13 ab 50 a8 2c ae c6 b2 eb 8a 59 8a a7 16 54 17 77 b1 62 d1 1c d1 68 8f a8 3c 58 4d fd 89 66 96 ba bd 70 76 9a a0 4a 66 55 6c 49 78 37 d0 4c 31 20 16 7c 36 a7 e2 c4 8c e7 b9 6e 8b 85 4e f1 e7 d5 b4 bf b0 27 58 72 44 f5 7e 6e 45 a5 6a 5e e9 c6 22 92 b4 48 db 18 93 8f f9 d2 7a 2c 9f 24 6d e0 40 5a 99 10 f6 08 55 2a 45 b0 22 23 56 5d 0c e5 c0 b4 b3 99 6d c0 82 df 65 67 af e9 c4 a6 8a 1b b3 2f 73 5b 2e b4 05 aa 34 88 fa ba a9 d9 8e b4 2e 15 63 b9 9d 53 ba 70 62 4b 37 a7 d9 17 6c f6 7a 48 2a f7 aa 0d 3f 3b b1 e8 22 f1 53 17 85 fe 4c b3 e9 16 05 1f b7 ab 50 dd 9a 66 b1 c5 89 4f 89 01 77 66 a4 16 78 4c c5 95 5d 46 c4 c0 c6 d2 a6 4b 23 ee cf 08 85 f7 86 a8 4d 9c 48 1e 28 09 ed a2 08 4a 04 aa 85 33 91 e7 96 99 2d e6 c9 a7 ad 3e d9 89 56 34 a9 48 02 75 db a4 7d 77 3c 11 89 35 df 2d 13 6b 67 45 51 17 9b 72 6f 26 5c 3d a8 b1 bf 70 e3 32 76 20 a4 8e 24 eb ae 20 8b ce 83 ca b5 d3 99 11 d2 fd 6a 7a 75 a7 c5 5a 68 4d 70 36 ef 62 a6 d9 e5 64 15 ab 11 12 61 d7 88 b0 65 08 3d c1 8e a0 65 8c ef 16 c8 80 cf 3a bc 1b f0 bd 86 73 c1 7f 52 a7 4a 77 d9 55 24 c3 50 67 86 29 3e 9a b6 9c 2c 13 fa 4c cc 2c b1 6c 9a eb 13 1a bb 53 18 6a 7b d4 c3 86 b3 31 ec d2 58 41 4a 15 5b 76 d5 48 1b 28 e2 dd d8 d9 cb 8a 99 f8 01 7e 50 44 2b 84 f7 73 1b ef 48 82 37 08 5a b2 3b 95 9f cc 09 e3 3c 5c 3d 43 ad 9c 09 f4 91 58 d6 d6 a6 2a 43 76 bf af 84 ce d6 0e 61 65 08 73 e9 d9 16 dd d5 58 4d d5 bd d9 77 f6 b4 98 77 fd 2e 96 58 e4 18 aa 45 0c d9 24 76 e9 ea a1 5f 3d 49 a8 fa ad 79 73 71 7e 71 de e9 00 9d 30 e0 02 16 c4 24 dd 30 90 7a a0 2b 08 20 0e 28 0d b8 31 d3 04 17 80 a5 80 94 04 6d 18 e1 c0 57 9f 80 c0 03 cc 27 e0 6f 06 04 59 9e c6 9c 05 3c 37 a0 05 f0 d2 1c 14 69 4c 38 c5 2d d2 e4 e2 dc db 24 88 05 69 c2 c7 29 5d b9 28 d2 4e 73 b5 2e c1 d7 8b f3 b3 5d 90 e0 74 d7 a6 29 72 6b 58 3b 27 19 75 11 69 fd 64 cd f7 4d 2f 1b 7d f8 a3 79 c9 eb 7f a9 25 b0 bc 3a b0 79 ad 05 03 39 ce 8d 93 94 11 28 08 3b 35 5a ff 5c f2 f7 5a 66 3d c7 59 6d 7e 2f fb 7c 2a 7d 04 e0 0f 41 b2 ce 8b 71 71 eb 6b 9c 26 01 4b 79 d7 fa ba 2e be 20 2f 07 ea 77 1a 7f 3e
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 12 Feb 2025 15:34:28 GMTserver: Apachelast-modified: Tue, 22 Oct 2024 03:25:40 GMTetag: "85c0-6250852d63500-gzip"accept-ranges: bytesvary: Accept-Encodingcontent-encoding: gzipcontent-length: 14345content-type: application/javascriptconnection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 5b 57 e3 c8 96 e6 7b af d5 ff c1 28 ab b3 a4 44 36 92 2f 24 98 54 b1 80 e4 96 05 24 09 24 90 76 f9 70 64 29 b0 95 e8 e2 d2 c5 60 12 cf 5f 98 df d0 f3 3a 0f 33 8f fd 34 0f a7 57 ff af f9 76 84 6e 36 86 aa 3a 6b 1e e6 9c 2c 2c 45 ec 88 d8 11 b1 63 df 22 62 6b e5 dd bb 7f fd 97 ca bb ca 9e e3 0f 58 38 0a 1d 3f fe 74 5e 19 37 6a cd 9a 56 a9 56 76 82 d1 24 74 06 c3 b8 22 5b ca 2c 90 5a 39 f4 2d b5 52 d7 ea 8d 8a 3c 8c e3 51 d4 5e 59 b9 2d 20 6a 56 e0 29 bc ee 23 c7 62 7e c4 ec 4a e2 db 2c ac c4 43 56 39 3e bc 10 85 50 e6 fe fe be 16 8c 00 11 24 a1 c5 6a 41 38 58 71 45 89 68 c5 73 e2 6a fa 52 1b 0d 47 4a 25 7b a1 8a 79 e5 17 43 27 aa 44 c1 6d 7c 6f 86 ac 62 05 7e 6c 3a 7e 84 07 9b 55 6e c3 c0 ab 50 d5 55 51 77 65 14 06 df 99 15 47 6d 5e f4 38 09 bd 24 3c 30 a3 61 a3 d2 9f 54 7e 35 43 d3 af 1c 4d 02 14 cf 3b 34 70 e2 61 d2 a7 be ac dc 51 be 4b d9 2b 5e 51 b2 f6 3d e2 bd 5c f9 d7 7f 19 9b e1 ec 10 19 b7 89 6f c5 4e e0 cb 4c f9 21 25 11 ab 44 71 e8 58 b1 b4 41 a0 7e 91 ad fc 08 59 9c 84 3e d2 3e f7 09 c3 9a 19 45 ce c0 7f 7a 2a d7 70 1b 84 32 2f a8 c6 86 ae 86 86 19 0e 12 8f f9 71 54 73 99 3f 88 87 1b f1 87 70 23 5e 5e 56 32 c0 a0 e2 50 95 39 5c 37 ee 29 69 fd 18 89 38 88 27 23 56 1b 9a d1 e7 7b ff 34 c4 38 85 f1 a4 66 99 ae 2b fb 6a a0 bc 7d 2b b3 6e d0 33 7c fc 51 36 52 fc d8 54 f5 6b e6 68 e4 4e e4 18 03 af e6 55 2b d3 8d 0c d5 4a 2c 33 15 38 aa 61 d1 2d 76 2f c7 4f 4f 72 6c a0 1d cf 89 98 a2 c8 72 de b5 40 35 d1 b9 ac b4 43 5d 8d c3 c9 8f 44 0e 6b 3e 7b 40 6d 8a 32 b5 cc d8 1a ca be f2 c3 c4 9f e9 34 87 b6 ca d0 f1 30 0c ee 5f 05 4f 08 9c 8f e1 06 ab d9 81 cf 36 03 99 d5 c6 a6 9b 30 a5 2d fb 46 fa ac 02 0d 3f 8a 4d df 62 c1 6d 25 de f4 db e8 01 fa 25 97 a7 83 51 d5 8a a2 a0 59 e6 cb 8e 6a 29 d3 44 96 43 23 4c 07 08 b5 3c 3d 75 7b 00 e0 bd 50 08 b8 c0 24 a4 7c 81 0b 46 4a c5 18 a8 8e f1 c3 35 fb cc 6d 6b 6a 84 31 6d 97 c8 c3 b9 95 f5 b7 41 57 eb 29 bc 8f 95 a0 ab f7 b2 39 a1 e7 a9 8a 31 88 da dd 9e 1a 8c e8 67 9a 65 9a c6 0f 6a bd 6d c9 9a a2 f2 b2 78 d4 15 55 64 e3 b9 ae 4c 55 29 6b 49 32 0c a2 09 f4 f9 7c e2 f5 03 17 34 60 76 c5 63 cd 89 59 68 c6 41 d8 5b 40 b6 44 0b 53 45 35 37 4a f3 62 e5 b9 39 7c f2 3c c9 e2 7d 8b d3 6e d1 28 5f 00 81 dd 30 04 09 4b fb cc 17 6d 56 b0 c6 4d 37 64 a6 3d a9 b0 07 66 25 31 96 59 4d 52 36 88 d2 37 4c 42 d3 d0 54 0b e3 83 47 c7 d0 14 45 75 36 14 22 0b aa 9c 16 0b d2 03 a3 fe 96 40 36 c3 5a d6 7b f1 c6 db 06 75 02 22 cb 02 f5 07 62 29 84 8a aa 29 6d 41 89 48 5d 02 50 96 83 06 75 9a 5e a2 23 25 9b 8c 8d e8 de 21 da 0b 81 50 80 56 2d a3 2b 9a 55 03 41 5b 3d 85 23 aa fc b0 4c 30 04 ad cd 7f f4 76 60 58 1b 7d f4 f0 6e 83 27 34 db 69 85 4e 8d d3 c4 f2 b2 fa 83 17 6f 53 a3 2a 35 d9 5e d2 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 12 Feb 2025 15:34:29 GMTserver: Apachelast-modified: Tue, 22 Oct 2024 03:25:40 GMTetag: "85c0-6250852d63500-gzip"accept-ranges: bytesvary: Accept-Encodingcontent-encoding: gzipcontent-length: 14345content-type: application/javascriptconnection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 5b 57 e3 c8 96 e6 7b af d5 ff c1 28 ab b3 a4 44 36 92 2f 24 98 54 b1 80 e4 96 05 24 09 24 90 76 f9 70 64 29 b0 95 e8 e2 d2 c5 60 12 cf 5f 98 df d0 f3 3a 0f 33 8f fd 34 0f a7 57 ff af f9 76 84 6e 36 86 aa 3a 6b 1e e6 9c 2c 2c 45 ec 88 d8 11 b1 63 df 22 62 6b e5 dd bb 7f fd 97 ca bb ca 9e e3 0f 58 38 0a 1d 3f fe 74 5e 19 37 6a cd 9a 56 a9 56 76 82 d1 24 74 06 c3 b8 22 5b ca 2c 90 5a 39 f4 2d b5 52 d7 ea 8d 8a 3c 8c e3 51 d4 5e 59 b9 2d 20 6a 56 e0 29 bc ee 23 c7 62 7e c4 ec 4a e2 db 2c ac c4 43 56 39 3e bc 10 85 50 e6 fe fe be 16 8c 00 11 24 a1 c5 6a 41 38 58 71 45 89 68 c5 73 e2 6a fa 52 1b 0d 47 4a 25 7b a1 8a 79 e5 17 43 27 aa 44 c1 6d 7c 6f 86 ac 62 05 7e 6c 3a 7e 84 07 9b 55 6e c3 c0 ab 50 d5 55 51 77 65 14 06 df 99 15 47 6d 5e f4 38 09 bd 24 3c 30 a3 61 a3 d2 9f 54 7e 35 43 d3 af 1c 4d 02 14 cf 3b 34 70 e2 61 d2 a7 be ac dc 51 be 4b d9 2b 5e 51 b2 f6 3d e2 bd 5c f9 d7 7f 19 9b e1 ec 10 19 b7 89 6f c5 4e e0 cb 4c f9 21 25 11 ab 44 71 e8 58 b1 b4 41 a0 7e 91 ad fc 08 59 9c 84 3e d2 3e f7 09 c3 9a 19 45 ce c0 7f 7a 2a d7 70 1b 84 32 2f a8 c6 86 ae 86 86 19 0e 12 8f f9 71 54 73 99 3f 88 87 1b f1 87 70 23 5e 5e 56 32 c0 a0 e2 50 95 39 5c 37 ee 29 69 fd 18 89 38 88 27 23 56 1b 9a d1 e7 7b ff 34 c4 38 85 f1 a4 66 99 ae 2b fb 6a a0 bc 7d 2b b3 6e d0 33 7c fc 51 36 52 fc d8 54 f5 6b e6 68 e4 4e e4 18 03 af e6 55 2b d3 8d 0c d5 4a 2c 33 15 38 aa 61 d1 2d 76 2f c7 4f 4f 72 6c a0 1d cf 89 98 a2 c8 72 de b5 40 35 d1 b9 ac b4 43 5d 8d c3 c9 8f 44 0e 6b 3e 7b 40 6d 8a 32 b5 cc d8 1a ca be f2 c3 c4 9f e9 34 87 b6 ca d0 f1 30 0c ee 5f 05 4f 08 9c 8f e1 06 ab d9 81 cf 36 03 99 d5 c6 a6 9b 30 a5 2d fb 46 fa ac 02 0d 3f 8a 4d df 62 c1 6d 25 de f4 db e8 01 fa 25 97 a7 83 51 d5 8a a2 a0 59 e6 cb 8e 6a 29 d3 44 96 43 23 4c 07 08 b5 3c 3d 75 7b 00 e0 bd 50 08 b8 c0 24 a4 7c 81 0b 46 4a c5 18 a8 8e f1 c3 35 fb cc 6d 6b 6a 84 31 6d 97 c8 c3 b9 95 f5 b7 41 57 eb 29 bc 8f 95 a0 ab f7 b2 39 a1 e7 a9 8a 31 88 da dd 9e 1a 8c e8 67 9a 65 9a c6 0f 6a bd 6d c9 9a a2 f2 b2 78 d4 15 55 64 e3 b9 ae 4c 55 29 6b 49 32 0c a2 09 f4 f9 7c e2 f5 03 17 34 60 76 c5 63 cd 89 59 68 c6 41 d8 5b 40 b6 44 0b 53 45 35 37 4a f3 62 e5 b9 39 7c f2 3c c9 e2 7d 8b d3 6e d1 28 5f 00 81 dd 30 04 09 4b fb cc 17 6d 56 b0 c6 4d 37 64 a6 3d a9 b0 07 66 25 31 96 59 4d 52 36 88 d2 37 4c 42 d3 d0 54 0b e3 83 47 c7 d0 14 45 75 36 14 22 0b aa 9c 16 0b d2 03 a3 fe 96 40 36 c3 5a d6 7b f1 c6 db 06 75 02 22 cb 02 f5 07 62 29 84 8a aa 29 6d 41 89 48 5d 02 50 96 83 06 75 9a 5e a2 23 25 9b 8c 8d e8 de 21 da 0b 81 50 80 56 2d a3 2b 9a 55 03 41 5b 3d 85 23 aa fc b0 4c 30 04 ad cd 7f f4 76 60 58 1b 7d f4 f0 6e 83 27 34 db 69 85 4e 8d d3 c4 f2 b2 fa 83 17 6f 53 a3 2a 35 d9 5e d2 a
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKdate: Wed, 12 Feb 2025 15:34:29 GMTserver: Apachevary: Accept-Encodingcontent-encoding: gzipcontent-length: 989content-type: text/html; charset=UTF-8connection: closeData Raw: 1f 8b 08 00 00 00 00 00 00 03 95 95 5b 6f db 36 14 c7 df 0b f4 3b 08 19 b6 b4 33 16 53 92 5d cc 6d dc a1 ae 2e 8e 6c 31 b1 4c 52 16 5f 06 8a 94 23 c9 d4 a5 12 e3 5b bb ef 3e 3b 4e 81 dc 1e 36 be 08 fa 93 bf a3 3f 75 78 78 2e 53 55 c8 cf 6f df 5c a6 09 13 c7 a7 ca 94 4c 3e 0b 51 b5 6d c2 9b 44 b5 17 bc 2a 2e bb 27 f9 30 df f2 26 ab 95 a6 76 75 32 3c 53 c9 56 75 73 b6 66 27 f5 ec b0 60 cd 1a ad 49 44 d6 24 5c fd 2d b3 72 a5 0d b5 f3 54 a9 fa 63 b7 2b 76 89 ba cb 8e 01 bb 4b e3 a2 4e eb bf 92 21 90 8b 7e 38 5d 0a 16 58 6e 3e 9e 85 30 66 4b b7 ec 0d 96 32 0d 26 3a ac b9 5b 83 39 f0 9b 68 45 00 77 3c 28 40 4d 84 a1 6a e4 78 1e 05 5e 3e dd 29 9f 3b b0 f2 89 83 90 5d e7 c8 72 74 96 c3 2d 2a e5 58 94 fe 6e 0a 5a 43 00 69 33 bd fe 1a 94 bc 09 4b aa 08 5e f5 b0 2e af 45 21 10 95 32 82 ee 46 a7 21 06 f1 e2 16 44 87 e8 c2 ed 99 5c 7a fd c8 94 64 62 78 0c b9 5b 46 0c 1a 90 32 ea 93 62 1b 20 63 f0 2d 2c 1d 10 60 18 46 fb f4 3a 91 b7 7d 6a d6 25 cf 05 89 f3 f4 e6 7a 81 d7 10 f3 fd b5 25 54 88 b7 db 39 ee a7 d0 1e d4 73 c3 bb 99 ad a8 85 73 b2 8e 2d e2 60 17 a6 b4 20 29 23 a3 2b bc 17 16 31 82 76 6a 8e 64 a0 7b 0d db db 46 e8 f6 0b df a9 7b 78 41 c1 dc de f4 84 bd fd c0 f5 2f 7d df a4 3a df 8f 30 c1 0a 4c 4c 6e 42 93 ef e1 78 14 31 ac 6a df a5 2a c2 b4 e2 39 ee 43 d0 cf 92 d5 a0 3a e8 e9 bc a4 ad 1f aa 96 59 f4 2a ce 3d 87 95 9e 3f 97 a3 08 b9 fd 49 20 bd 20 58 a9 3b 94 af 1a 16 7a 10 01 a2 66 a4 ea 13 24 42 6e ca 35 77 66 66 6c a8 6f dc 14 d3 b9 5b af e9 4a 4c b0 19 98 33 63 3b 0d 0a e2 c1 3d 6e 62 5c 5b cc 26 25 1d 8b 35 2d 45 36 77 68 1a 49 0a e3 b9 b2 91 4d eb 24 ac ad 78 ec ef 90 ed cd 42 72 65 4c 4c a7 e5 85 94 10 6c ef 84 1d 84 d8 a9 15 b6 84 15 97 51 13 e8 02 71 94 46 71 e1 40 0c a0 4b 43 d1 83 c6 e0 c6 c7 de 86 93 ba 40 7a 3a 23 40 ff 40 dd 20 83 20 c8 f9 5e 5c a1 55 7d 03 09 75 af 43 ba 8e 31 b1 fc 02 eb f3 50 5c 51 e3 cf 0d 5d c8 d2 5f 04 16 91 f5 57 26 23 83 e9 29 9b ed 06 5f 85 eb e4 f1 82 7c 40 87 13 72 70 6e 51 44 73 11 82 86 8c c5 c4 27 5e 03 c1 cc 38 c4 d8 53 94 ce 23 73 54 08 67 64 11 e2 58 11 22 0e 1c a7 21 73 a1 8e 76 83 59 ec 44 5b 86 82 b9 70 e8 6c 7a c8 0d 2d 53 12 8e bd 46 b8 94 71 db 19 21 fd cb da 2f 82 3d 0c d3 bb 19 48 25 b7 fd 1e 09 f5 1d 46 e0 57 d3 3a ff 74 aa 9a 75 7b 2c 95 df d6 ed f0 bc b3 c9 4a 51 6d 2e b2 b2 4c 9a 30 13 2a d5 3a da f9 c7 a7 fa 38 c9 6e 53 f5 00 8b 13 2c 1e c1 87 9a 4c 92 f2 62 f3 12 7f 98 49 1f 07 68 e5 7d 80 56 3e 0f b0 78 8d 8d 1e a8 ea f4 d9 aa 1d 2e 8f db 78 fb 26 5b be 7b 46 7f 1e 6a af 18 7a af 7d 7f 04 ab f3 4f da 3f 2f e1 e8 25 7c f2 fc 2a 7d f4 53 3e a8 e5 4f 47 ff d5 cf 1f ef 5e 11 7f 07 17 fa 7b ed c7 0f ed c5 0f 79 99 9f cb 17 d2 89 fe fe c4 d3 ff dd e8 73 5b 27 f5 75 5f d1 33 5f a7 f3 f1 d4 d8 f8 11 ff aa b3 b7 6f 1e 96 cb 8a 33 95 55 e5 45 93 d4 92 f1 e4 dd 93 4b bd b3 6e 3b a2 ed b4 b2 53 b5

Source: global traffic	HTTP traffic detected: GET /LexipolLeaks/Lexipol.7z HTTP/1.1Host: data.ddosecrets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=htt&oit=1&cp=3&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=http&oit=1&cp=4&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https&oit=1&cp=5&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A&oit=4&cp=6&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F&oit=4&cp=7&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2F&oit=4&cp=8&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fle&oit=3&cp=10&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Flex&oit=3&cp=11&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Flexi&oit=3&cp=12&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Flex&oit=3&cp=11&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fl&oit=3&cp=9&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2F&oit=4&cp=8&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddos&oit=3&cp=12&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddoss&oit=3&cp=13&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddosse&oit=3&cp=14&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossec&oit=3&cp=15&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecr&oit=3&cp=16&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecre&oit=3&cp=17&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecrets&oit=3&cp=19&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecrets.&oit=3&cp=20&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecrets.com&oit=3&cp=23&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /article/lexipolleaks HTTP/1.1Host: ddossecrets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /article/lexipolleaks?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTczOTM4MTY2NSwiaWF0IjoxNzM5Mzc0NDY1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMGhudm4zYjN0bzE1dHNucTgwNml2NDMiLCJuYmYiOjE3MzkzNzQ0NjUsInRzIjoxNzM5Mzc0NDY1NzYxODM2fQ.CgLvQmQ6m37EDdZFDiEX0Eqo5OBc-CC3vhFmLiKj3bA&sid=d7225447-e956-11ef-ac7f-aa0fcda9204b HTTP/1.1Host: ddossecrets.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://ddossecrets.com/article/lexipolleaksAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: sid=d7225447-e956-11ef-ac7f-aa0fcda9204b
Source: global traffic	HTTP traffic detected: GET /click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5 HTTP/1.1Host: pephytriastared.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: http://dyetui.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /landers/vpn_prop_orange_c/en/dl.min.js.html HTTP/1.1Host: pephytriastared.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uclick=h9syzwbz1n; uclickhash=h9syzwbz1n-h9syzwbz1n-iru3-8rxovr-52a7vr-uqwhi4-uqwhfe-e03528
Source: global traffic	HTTP traffic detected: GET /landers/vpn_prop_orange_c/en/jquery.min.js HTTP/1.1Host: pephytriastared.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uclick=h9syzwbz1n; uclickhash=h9syzwbz1n-h9syzwbz1n-iru3-8rxovr-52a7vr-uqwhi4-uqwhfe-e03528
Source: global traffic	HTTP traffic detected: GET /landers/vpn_prop_orange_c/en/aff_i HTTP/1.1Host: pephytriastared.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uclick=h9syzwbz1n; uclickhash=h9syzwbz1n-h9syzwbz1n-iru3-8rxovr-52a7vr-uqwhi4-uqwhfe-e03528
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pephytriastared.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: uclick=h9syzwbz1n; uclickhash=h9syzwbz1n-h9syzwbz1n-iru3-8rxovr-52a7vr-uqwhi4-uqwhfe-e03528
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEIucrNAQiJ080BGMvYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=le&oit=1&cp=2&pgcl=7&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=lex&oit=1&cp=3&pgcl=7&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=qr25E7lN3dG5xPLupXVWCo0SuAaT1t-5PYhkQ0mQtbs-PE0EO_raXQsGocF2dz62gDZYczTFb7-Q1bfWj4tAb52glDj0oaxN9SUxYTI2SSya9ZJoG3QG0pbC7A8GFQLG-SUuUa3CT7KHDnOnK9jslvH3uyWFd5G_BpTLSH3qQH9cw41XjDtpmvYwJgeQKkpxYw
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=lexi&oit=1&cp=4&pgcl=7&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=521=qr25E7lN3dG5xPLupXVWCo0SuAaT1t-5PYhkQ0mQtbs-PE0EO_raXQsGocF2dz62gDZYczTFb7-Q1bfWj4tAb52glDj0oaxN9SUxYTI2SSya9ZJoG3QG0pbC7A8GFQLG-SUuUa3CT7KHDnOnK9jslvH3uyWFd5G_BpTLSH3qQH9cw41XjDtpmvYwJgeQKkpxYw
Source: global traffic	HTTP traffic detected: GET /f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy HTTP/1.1Host: dyetui.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/fingerprint/iife.min.js HTTP/1.1Host: dyetui.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cyAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: dyetui.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cyAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js/fingerprint/iife.min.js HTTP/1.1Host: dyetui.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=-7 HTTP/1.1Host: dyetui.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cyAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=a3db7cd464228025d120ca597c81b5f2 HTTP/1.1Host: dyetui.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cyAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f2.php?e=0lX5WLfdaRDGjHQWNbafGn49flhRK1NpcGp0S0MrYkV0cFJNd0pVd2tpTFJJZ0JjLytMcFNoMVFTTEpjTDF1ajNxTnlHdnMyL0s2d0lEa1pCRncrWnZtVUk4U1lOdmdTZllYNGw1ZWU0bXg0YVd2dG43clJ5Y3lVK2JaTGxaV2ZRVnY5VmxRT29qWnF0RUNWYzhOelg5Z3pncjdVbjhPOXUvNUczODdtWUxxSU5hNE9pS2JPQkZDUjVvbDVFUGNhZmVhaVBIUzdDV2RsL3BlR1JrazE2WG5mMFp4UXZ0SEw4dEx6c1A5M3Z1czBUVUt0K3c3N3czNHBYaUtpMGZtYUZocjU5N05iek9oaUthSnZsMWtsaDZIbjJFanJMSlBYTG5KRlJRRktuTjkraWJNT0VtQVo5VTdWc3lvcFQ3b2tqc3dLSGpvZkdKU3R3Q2xLRmVJNzUrbUpDaEVnZHdvZndiSFZhYlZNbStETEZpeWpDbHMyTEJQWVI2K3FscmllN0xudERWUFptUDdDbnYrR1dTcThYbmFNU0NGZWd4N29PMUJwcVpmT1hQV016ZGRiN0RjczdITkpPNVZGOWZvbUVDMmU1SWdIZ28wZXlnMXRDVlpCalY2a1haQy9CdGFjbXV6T2d0VnZDZTZjdW0rVHdKMVJrN0Q2SWdzZThSY3BmdFBDVVFDYTVFNHhWaGN1Ty9QbFYxaTRSdFZQL3Z1ZnhVWHJrdGZacEFBT1AvMmRzNWhuQ0hlcEM4VW1yUT0%3D&vs=1280:907&ds=1280:1024&sl=0:0&os=f&nos=f HTTP/1.1Host: dyetui.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=a3db7cd464228025d120ca597c81b5f2Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: chromecache_78.1.dr	String found in binary or memory: ["https",["https","https //kahoot.com join","https //quizlet.com live","https //www.microsoft.com /ink","https //www.gimkit.com join","https //www.blooket.com join","https://microsoft.com/link","https://www.google.com","https://www.epicgames.com/activate","https://www.youtube.com/"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[1300,600,553,552,551,550,403,402,401,400],"google:suggestsubtypes":[[512,433,131],[512],[512],[512,433],[512],[512],[44],[44],[44],[44]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","NAVIGATION","NAVIGATION","NAVIGATION","NAVIGATION"],"google:verbatimrelevance":1300}] equals www.youtube.com (Youtube)
Source: chromecache_90.1.dr	String found in binary or memory: ["https:",["https //kahoot.com join","https //quizlet.com live","https //chatgpt.com login","https //www.youtube music","https //www.microsoft.com /ink","https //www.yahoo.com mail","https //www.gimkit.com join","https //www.blooket.com join","https://microsoft.com/link","https://www.epicgames.com/activate"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,555,554,553,552,551,550,401,400],"google:suggestsubtypes":[[512],[512],[512,650,433],[512,650,433,131],[512,433],[512,650,433,131],[512],[512],[44],[44]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","NAVIGATION","NAVIGATION"],"google:verbatimrelevance":851}] equals www.yahoo.com (Yahoo)
Source: chromecache_90.1.dr	String found in binary or memory: ["https:",["https //kahoot.com join","https //quizlet.com live","https //chatgpt.com login","https //www.youtube music","https //www.microsoft.com /ink","https //www.yahoo.com mail","https //www.gimkit.com join","https //www.blooket.com join","https://microsoft.com/link","https://www.epicgames.com/activate"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,555,554,553,552,551,550,401,400],"google:suggestsubtypes":[[512],[512],[512,650,433],[512,650,433,131],[512,433],[512,650,433,131],[512],[512],[44],[44]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","NAVIGATION","NAVIGATION"],"google:verbatimrelevance":851}] equals www.youtube.com (Youtube)
Source: chromecache_86.1.dr	String found in binary or memory: ["https://",["https //kahoot.com join","https //www.youtube music","https //quizlet.com live","https //chatgpt.com login","https //www.microsoft.com /ink","https //www.yahoo.com mail","https //www.gimkit.com join","https //www.blooket.com join","https://microsoft.com/link","https://www.epicgames.com/activate"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,555,554,553,552,551,550,401,400],"google:suggestsubtypes":[[512,433],[512,650,433,131],[512],[512,650,433],[512,433],[512,650,433,131],[512],[512],[44],[44]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","NAVIGATION","NAVIGATION"],"google:verbatimrelevance":851}] equals www.yahoo.com (Yahoo)
Source: chromecache_86.1.dr	String found in binary or memory: ["https://",["https //kahoot.com join","https //www.youtube music","https //quizlet.com live","https //chatgpt.com login","https //www.microsoft.com /ink","https //www.yahoo.com mail","https //www.gimkit.com join","https //www.blooket.com join","https://microsoft.com/link","https://www.epicgames.com/activate"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestrelevance":[601,600,555,554,553,552,551,550,401,400],"google:suggestsubtypes":[[512,433],[512,650,433,131],[512],[512,650,433],[512,433],[512,650,433,131],[512],[512],[44],[44]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","NAVIGATION","NAVIGATION"],"google:verbatimrelevance":851}] equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: data.ddosecrets.com
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ddossecrets.com
Source: global traffic	DNS traffic detected: DNS query: dyetui.com
Source: global traffic	DNS traffic detected: DNS query: pephytriastared.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /report/v4?s=EDruFvqBXLiS5bcjUb4V3VeYK9fFUE2v2v0DQNTAbHHMU7WcHObkjn%2FDoWdNKJ0VrAR9z6G6dyOib8mwAUPdUcC5D%2FwnTKHaKQ3kfR634%2FAdOvPZin%2FOJi8Qwwdvr%2BvIdi%2Bv7Iw%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 410Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Wed, 12 Feb 2025 15:34:32 GMTContent-Type: text/htmlContent-Length: 555Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Wed, 12 Feb 2025 15:34:32 GMTContent-Type: text/htmlContent-Length: 555Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Wed, 12 Feb 2025 15:34:32 GMTContent-Type: text/htmlContent-Length: 555Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.24.0Date: Wed, 12 Feb 2025 15:34:33 GMTContent-Type: text/htmlContent-Length: 555Connection: close

Source: chromecache_91.1.dr	String found in binary or memory: http://www.broofa.com
Source: chromecache_85.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_85.1.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_85.1.dr, chromecache_91.1.dr	String found in binary or memory: https://apis.google.com
Source: chromecache_85.1.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_85.1.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_80.1.dr	String found in binary or memory: https://ddossecrets.com
Source: chromecache_97.1.dr	String found in binary or memory: https://ddossecrets.com/article/lexipolleaks?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOi
Source: chromecache_85.1.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_91.1.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chromecache_83.1.dr	String found in binary or memory: https://lending.sba.gov
Source: chromecache_74.1.dr	String found in binary or memory: https://lex.aafes.com
Source: chromecache_74.1.dr, chromecache_93.1.dr	String found in binary or memory: https://lexica.art
Source: chromecache_74.1.dr, chromecache_93.1.dr	String found in binary or memory: https://lexile.com
Source: chromecache_74.1.dr, chromecache_93.1.dr	String found in binary or memory: https://lexin.nada.kth.se/
Source: chromecache_93.1.dr	String found in binary or memory: https://lexingtontn.gov/utilities.html
Source: chromecache_74.1.dr	String found in binary or memory: https://lexpress.mu
Source: chromecache_83.1.dr	String found in binary or memory: https://login.certus.com
Source: chromecache_83.1.dr	String found in binary or memory: https://login.i-ready.com
Source: chromecache_83.1.dr	String found in binary or memory: https://login.i-ready.com/student/dashboard/home
Source: chromecache_83.1.dr	String found in binary or memory: https://login.microsoftonline.com
Source: chromecache_91.1.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_85.1.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_85.1.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_95.1.dr	String found in binary or memory: https://trk.playstretch.host/aff_c?source=2424-yo_WininsNC_TopG&offer_id=235&aff_click_id=mem_yo_Win
Source: chromecache_85.1.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: chromecache_85.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_85.1.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_91.1.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_91.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_91.1.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989

Source: classification engine

Classification label: mal52.win@24/73@18/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\d1939e8f-488e-4394-b7e6-68336df483f3.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1828,i,10876008150740969365,11341645373394169404,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1828,i,10876008150740969365,11341645373394169404,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	5 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	6 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=a3db7cd464228025d120ca597c81b5f2	100%	Avira URL Cloud	phishing
https://lexin.nada.kth.se/	0%	Avira URL Cloud	safe
http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=-7	100%	Avira URL Cloud	phishing
https://pephytriastared.com/landers/vpn_prop_orange_c/en/jquery.min.js	100%	Avira URL Cloud	malware
https://pephytriastared.com/favicon.ico	100%	Avira URL Cloud	malware
http://dyetui.com/js/fingerprint/iife.min.js	100%	Avira URL Cloud	phishing
https://lexingtontn.gov/utilities.html	0%	Avira URL Cloud	safe
https://ddossecrets.com	0%	Avira URL Cloud	safe
http://dyetui.com/favicon.ico	100%	Avira URL Cloud	phishing
http://dyetui.com/f2.php?e=0lX5WLfdaRDGjHQWNbafGn49flhRK1NpcGp0S0MrYkV0cFJNd0pVd2tpTFJJZ0JjLytMcFNoMVFTTEpjTDF1ajNxTnlHdnMyL0s2d0lEa1pCRncrWnZtVUk4U1lOdmdTZllYNGw1ZWU0bXg0YVd2dG43clJ5Y3lVK2JaTGxaV2ZRVnY5VmxRT29qWnF0RUNWYzhOelg5Z3pncjdVbjhPOXUvNUczODdtWUxxSU5hNE9pS2JPQkZDUjVvbDVFUGNhZmVhaVBIUzdDV2RsL3BlR1JrazE2WG5mMFp4UXZ0SEw4dEx6c1A5M3Z1czBUVUt0K3c3N3czNHBYaUtpMGZtYUZocjU5N05iek9oaUthSnZsMWtsaDZIbjJFanJMSlBYTG5KRlJRRktuTjkraWJNT0VtQVo5VTdWc3lvcFQ3b2tqc3dLSGpvZkdKU3R3Q2xLRmVJNzUrbUpDaEVnZHdvZndiSFZhYlZNbStETEZpeWpDbHMyTEJQWVI2K3FscmllN0xudERWUFptUDdDbnYrR1dTcThYbmFNU0NGZWd4N29PMUJwcVpmT1hQV016ZGRiN0RjczdITkpPNVZGOWZvbUVDMmU1SWdIZ28wZXlnMXRDVlpCalY2a1haQy9CdGFjbXV6T2d0VnZDZTZjdW0rVHdKMVJrN0Q2SWdzZThSY3BmdFBDVVFDYTVFNHhWaGN1Ty9QbFYxaTRSdFZQL3Z1ZnhVWHJrdGZacEFBT1AvMmRzNWhuQ0hlcEM4VW1yUT0%3D&vs=1280:907&ds=1280:1024&sl=0:0&os=f&nos=f	100%	Avira URL Cloud	phishing
https://pephytriastared.com/landers/vpn_prop_orange_c/en/aff_i	100%	Avira URL Cloud	malware
https://lexile.com	0%	Avira URL Cloud	safe
https://ddossecrets.com/article/lexipolleaks?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOi	0%	Avira URL Cloud	safe
https://ddossecrets.com/article/lexipolleaks?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTczOTM4MTY2NSwiaWF0IjoxNzM5Mzc0NDY1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMGhudm4zYjN0bzE1dHNucTgwNml2NDMiLCJuYmYiOjE3MzkzNzQ0NjUsInRzIjoxNzM5Mzc0NDY1NzYxODM2fQ.CgLvQmQ6m37EDdZFDiEX0Eqo5OBc-CC3vhFmLiKj3bA&sid=d7225447-e956-11ef-ac7f-aa0fcda9204b	0%	Avira URL Cloud	safe
https://ddossecrets.com/article/lexipolleaks	0%	Avira URL Cloud	safe
https://trk.playstretch.host/aff_c?source=2424-yo_WininsNC_TopG&offer_id=235&aff_click_id=mem_yo_Win	0%	Avira URL Cloud	safe
https://pephytriastared.com/landers/vpn_prop_orange_c/en/dl.min.js.html	100%	Avira URL Cloud	malware
https://lex.aafes.com	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
pephytriastared.com	3.21.173.71	true	true	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	high
plus.l.google.com	142.250.185.206	true	false	high
play.google.com	172.217.16.206	true	false	high
data.ddosecrets.com	104.26.3.199	true	false	unknown
ddossecrets.com	77.247.183.147	true	false	unknown
www.google.com	142.250.185.164	true	false	high
dyetui.com	103.224.182.206	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=7&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=lexi&oit=1&cp=4&pgcl=7&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=a3db7cd464228025d120ca597c81b5f2	false	Avira URL Cloud: phishing	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https&oit=1&cp=5&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F&oit=4&cp=7&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fl&oit=3&cp=9&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=htt&oit=1&cp=3&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=-7	false	Avira URL Cloud: phishing	unknown
https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5	false		unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.l2ZUC8FxqV8.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo9xAAkaXO7Lqf7-9uTpZLtrkpWaXQ/cb=gapi.loaded_0	false		high
http://dyetui.com/f2.php?e=0lX5WLfdaRDGjHQWNbafGn49flhRK1NpcGp0S0MrYkV0cFJNd0pVd2tpTFJJZ0JjLytMcFNoMVFTTEpjTDF1ajNxTnlHdnMyL0s2d0lEa1pCRncrWnZtVUk4U1lOdmdTZllYNGw1ZWU0bXg0YVd2dG43clJ5Y3lVK2JaTGxaV2ZRVnY5VmxRT29qWnF0RUNWYzhOelg5Z3pncjdVbjhPOXUvNUczODdtWUxxSU5hNE9pS2JPQkZDUjVvbDVFUGNhZmVhaVBIUzdDV2RsL3BlR1JrazE2WG5mMFp4UXZ0SEw4dEx6c1A5M3Z1czBUVUt0K3c3N3czNHBYaUtpMGZtYUZocjU5N05iek9oaUthSnZsMWtsaDZIbjJFanJMSlBYTG5KRlJRRktuTjkraWJNT0VtQVo5VTdWc3lvcFQ3b2tqc3dLSGpvZkdKU3R3Q2xLRmVJNzUrbUpDaEVnZHdvZndiSFZhYlZNbStETEZpeWpDbHMyTEJQWVI2K3FscmllN0xudERWUFptUDdDbnYrR1dTcThYbmFNU0NGZWd4N29PMUJwcVpmT1hQV016ZGRiN0RjczdITkpPNVZGOWZvbUVDMmU1SWdIZ28wZXlnMXRDVlpCalY2a1haQy9CdGFjbXV6T2d0VnZDZTZjdW0rVHdKMVJrN0Q2SWdzZThSY3BmdFBDVVFDYTVFNHhWaGN1Ty9QbFYxaTRSdFZQL3Z1ZnhVWHJrdGZacEFBT1AvMmRzNWhuQ0hlcEM4VW1yUT0%3D&vs=1280:907&ds=1280:1024&sl=0:0&os=f&nos=f	false	Avira URL Cloud: phishing	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddosse&oit=3&cp=14&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://pephytriastared.com/landers/vpn_prop_orange_c/en/jquery.min.js	false	Avira URL Cloud: malware	unknown
https://pephytriastared.com/favicon.ico	false	Avira URL Cloud: malware	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=lex&oit=1&cp=3&pgcl=7&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://dyetui.com/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecrets.&oit=3&cp=20&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecrets.com&oit=3&cp=23&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecre&oit=3&cp=17&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=http&oit=1&cp=4&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/async/newtab_promos	false		high
http://dyetui.com/js/fingerprint/iife.min.js	false	Avira URL Cloud: phishing	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Flex&oit=3&cp=11&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Flexi&oit=3&cp=12&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecrets&oit=3&cp=19&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy	false		unknown
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fle&oit=3&cp=10&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z	false		unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecr&oit=3&cp=16&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://pephytriastared.com/landers/vpn_prop_orange_c/en/aff_i	false	Avira URL Cloud: malware	unknown
https://ddossecrets.com/article/lexipolleaks?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTczOTM4MTY2NSwiaWF0IjoxNzM5Mzc0NDY1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMGhudm4zYjN0bzE1dHNucTgwNml2NDMiLCJuYmYiOjE3MzkzNzQ0NjUsInRzIjoxNzM5Mzc0NDY1NzYxODM2fQ.CgLvQmQ6m37EDdZFDiEX0Eqo5OBc-CC3vhFmLiKj3bA&sid=d7225447-e956-11ef-ac7f-aa0fcda9204b	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddos&oit=3&cp=12&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://ddossecrets.com/article/lexipolleaks	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A&oit=4&cp=6&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddoss&oit=3&cp=13&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=le&oit=1&cp=2&pgcl=7&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://a.nel.cloudflare.com/report/v4?s=EDruFvqBXLiS5bcjUb4V3VeYK9fFUE2v2v0DQNTAbHHMU7WcHObkjn%2FDoWdNKJ0VrAR9z6G6dyOib8mwAUPdUcC5D%2FwnTKHaKQ3kfR634%2FAdOvPZin%2FOJi8Qwwdvr%2BvIdi%2Bv7Iw%3D	false		high
https://pephytriastared.com/landers/vpn_prop_orange_c/en/dl.min.js.html	false	Avira URL Cloud: malware	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossec&oit=3&cp=15&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2F&oit=4&cp=8&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.broofa.com	chromecache_91.1.dr	false		high
https://lending.sba.gov	chromecache_83.1.dr	false		high
https://login.i-ready.com	chromecache_83.1.dr	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_85.1.dr	false		high
https://lexica.art	chromecache_74.1.dr, chromecache_93.1.dr	false		high
https://login.microsoftonline.com	chromecache_83.1.dr	false		high
https://lexin.nada.kth.se/	chromecache_74.1.dr, chromecache_93.1.dr	false	Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_85.1.dr, chromecache_91.1.dr	false		high
https://lexingtontn.gov/utilities.html	chromecache_93.1.dr	false	Avira URL Cloud: safe	unknown
https://domains.google.com/suggest/flow	chromecache_85.1.dr	false		high
https://login.certus.com	chromecache_83.1.dr	false		high
https://ddossecrets.com	chromecache_80.1.dr	false	Avira URL Cloud: safe	unknown
https://login.i-ready.com/student/dashboard/home	chromecache_83.1.dr	false		high
https://ddossecrets.com/article/lexipolleaks?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOi	chromecache_97.1.dr	false	Avira URL Cloud: safe	unknown
https://lex.aafes.com	chromecache_74.1.dr	false	Avira URL Cloud: safe	unknown
https://plus.google.com	chromecache_85.1.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_91.1.dr	false		high
https://lexile.com	chromecache_74.1.dr, chromecache_93.1.dr	false	Avira URL Cloud: safe	unknown
https://trk.playstretch.host/aff_c?source=2424-yo_WininsNC_TopG&offer_id=235&aff_click_id=mem_yo_Win	chromecache_95.1.dr	false	Avira URL Cloud: safe	unknown
https://clients6.google.com	chromecache_85.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.3.199	data.ddosecrets.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.206	plus.l.google.com	United States	15169	GOOGLEUS	false
103.224.182.206	dyetui.com	Australia	133618	TRELLIAN-AS-APTrellianPtyLimitedAU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false
77.247.183.147	ddossecrets.com	Netherlands	43350	NFORCENL	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false
3.21.173.71	pephytriastared.com	United States	16509	AMAZON-02US	true

Private

IP
192.168.2.16
192.168.2.18

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1613262
Start date and time:	2025-02-12 16:32:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.win@24/73@18/10

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.163, 142.250.186.110, 64.233.167.84, 142.250.184.206, 172.217.16.142, 142.250.186.174, 142.250.185.110, 142.250.185.142, 142.250.184.238, 142.250.186.78, 172.217.16.206, 199.232.214.172, 172.217.18.3, 142.250.186.46, 142.250.185.174, 142.250.185.238, 216.58.206.67, 142.250.186.170, 142.250.184.202, 142.250.185.138, 142.250.185.106, 142.250.184.234, 216.58.206.42, 142.250.185.202, 142.250.185.170, 142.250.185.234, 216.58.206.74, 172.217.18.10, 172.217.23.106, 172.217.16.202, 142.250.181.234, 142.250.185.74, 142.250.74.202, 13.107.253.45, 172.202.163.200, 2.19.96.89
Excluded domains from analysis (whitelisted): www.bing.com, clients1.google.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, encrypted-tbn0.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
Not all processes where analyzed, report is missing behavior information
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Feb 12 14:32:44 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.986544167914669
Encrypted:	false
SSDEEP:	48:8+dHTfbKHWidAKZdA1FehwiZUklqeh0y+3:8uPDry
MD5:	BD7254EE8BC7C23C052062F2A0C2E20A
SHA1:	476F0ED704F0284970D58A93CB0F2BB389A6F77F
SHA-256:	85548D3D3D73D7F3CE6E178B72D8410558983A4EB287C1DDDB249E6E1A0E97D2
SHA-512:	2B612931923C4023345C007710A8F82DEFD5A1CFFB094393DFA7E6EE8E38F1B0E1D5FDDC6995DDD88FEE71E9285161E30A15CCAA3CF56104CB2AB01A1F346A48
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....N.\c}..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.ILZ.\|....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VLZ.\|....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VLZ.\|....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VLZ.\|..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VLZ.\|...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............C.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 12, 2025 16:32:43.853959084 CET	53	51628	1.1.1.1	192.168.2.16
Feb 12, 2025 16:32:43.972717047 CET	53	60323	1.1.1.1	192.168.2.16
Feb 12, 2025 16:32:44.708883047 CET	54882	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:32:44.709054947 CET	49799	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:32:44.719403028 CET	53	49799	1.1.1.1	192.168.2.16
Feb 12, 2025 16:32:44.722024918 CET	53	54882	1.1.1.1	192.168.2.16
Feb 12, 2025 16:32:44.962040901 CET	53	63912	1.1.1.1	192.168.2.16
Feb 12, 2025 16:32:45.705274105 CET	60750	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:32:45.705507994 CET	57901	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:32:45.713124990 CET	53	57901	1.1.1.1	192.168.2.16
Feb 12, 2025 16:32:45.713161945 CET	53	60750	1.1.1.1	192.168.2.16
Feb 12, 2025 16:32:48.632292986 CET	61554	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:32:48.632493973 CET	59129	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:32:48.639332056 CET	53	61554	1.1.1.1	192.168.2.16
Feb 12, 2025 16:32:48.639350891 CET	53	59129	1.1.1.1	192.168.2.16
Feb 12, 2025 16:33:01.965641975 CET	53	62010	1.1.1.1	192.168.2.16
Feb 12, 2025 16:33:20.742829084 CET	53	58399	1.1.1.1	192.168.2.16
Feb 12, 2025 16:33:31.865681887 CET	138	138	192.168.2.16	192.168.2.255
Feb 12, 2025 16:33:43.347804070 CET	53	54850	1.1.1.1	192.168.2.16
Feb 12, 2025 16:33:43.778315067 CET	53	63696	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:12.939589977 CET	53	62469	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:24.795452118 CET	61206	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:24.795615911 CET	50645	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:24.823563099 CET	53	61206	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:24.824302912 CET	53	50645	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:26.977760077 CET	52422	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:26.977988958 CET	61240	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:27.133770943 CET	53	52422	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:27.283279896 CET	53	61240	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:28.537766933 CET	51211	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:28.538047075 CET	54990	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:28.545418978 CET	53	51211	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:28.841279984 CET	53	54990	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:30.297565937 CET	59808	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:30.297707081 CET	59134	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:30.311129093 CET	53	59808	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:30.319694996 CET	53	59134	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:41.584387064 CET	53	53933	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:42.835470915 CET	61180	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:42.835612059 CET	59030	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:42.840962887 CET	53	64968	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:42.842422962 CET	53	59030	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:42.842447996 CET	53	61180	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:43.841552019 CET	54134	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:43.841703892 CET	65481	53	192.168.2.16	1.1.1.1
Feb 12, 2025 16:34:43.848450899 CET	53	65481	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:43.848548889 CET	53	54134	1.1.1.1	192.168.2.16
Feb 12, 2025 16:34:46.439594030 CET	53	62627	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 12, 2025 16:34:27.283406973 CET	192.168.2.16	1.1.1.1	c228	(Port unreachable)	Destination Unreachable
Feb 12, 2025 16:34:28.841357946 CET	192.168.2.16	1.1.1.1	c228	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2025 16:34:27.178668976 CET	1141	OUT	GET /f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy HTTP/1.1 Host: dyetui.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 12, 2025 16:34:27.790867090 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 12 Feb 2025 15:34:27 GMT server: Apache vary: Accept-Encoding content-encoding: gzip content-length: 1203 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 57 5b 73 da 38 18 7d 4e 66 f2 1f 34 74 66 21 d3 2d d8 e6 b2 4d 02 d9 69 02 22 31 b1 53 7c 05 bf ec 18 49 c6 17 f9 52 5b 80 4d 27 ff bd 32 90 76 bb fb b0 fb dc 89 5f 6c 49 e7 48 df 91 e7 1c d9 43 9f c5 f4 f6 e2 7c e8 13 17 d7 77 16 30 4a 6e 31 4e 8b 82 a0 9c b0 a2 8d d2 78 d8 39 76 f3 f1 02 e5 41 c6 00 ab 32 32 6a 30 52 b2 4e e8 6e dd 63 6f 03 14 39 1a 35 3a 61 d1 f1 82 64 4d f2 2c 0f 12 d6 09 02 8f b4 e3 20 69 87 45 e3 76 d8 39 62 ff 73 2e 0e d8 ba 39 c8 09 0e 72 82 d8 5f 34 48 22 30 02 4d 9f b1 ec ba d3 c1 15 61 9b a0 2e ae e3 b5 33 3f fb 93 8c 7a cb f0 41 5a 57 d3 8f 15 62 f7 41 39 97 3f 39 63 39 e9 5d 79 a1 26 d8 89 96 e1 85 35 56 a6 da 83 2a fa 0c 3d c8 c2 4a 67 92 1d fb d3 79 57 4b 55 db ca 5d ea 8c 97 b1 d6 77 a0 a6 58 13 ab 50 a8 2c ae c6 b2 eb 8a 59 8a a7 16 54 17 77 b1 62 d1 1c d1 68 8f a8 3c 58 4d fd 89 66 96 ba bd 70 76 9a a0 4a 66 55 6c 49 78 37 d0 4c 31 20 16 7c 36 a7 e2 c4 8c e7 b9 6e 8b 85 4e f1 e7 d5 b4 bf b0 27 58 72 44 f5 7e 6e 45 a5 6a 5e e9 c6 22 [TRUNCATED] Data Ascii: W[s8}Nf4tf!-Mi"1S\|IR[M'2v_lIHC\|w0Jn1Nx9vA22j0RNnco95:adM, iEv9bs.9r_4H"0Ma.3?zAZWbA9?9c9]y&5V=JgyWKU]wXP,YTwbh<XMfpvJfUlIx7L1 \|6nN'XrD~nEj^"Hz,$m@ZUE"#V]meg/s[.4.cSpbK7lzH?;"SLPfOwfxL]FK#MH(J3->V4Hu}w<5-kgEQro&\=p2v $ jzuZhMp6bdae=e:sRJwU$Pg)>,L,lSj{1XAJ[vH(~PD+sH7Z;<\=CXCvaesXMww.XE$v_=Iysq~q0$0z+ (1mW'oY<7iL8-$i)](Ns.]t)rkX;'uidM/}y%:y9(;5Z\Zf=Ym~/\|*}Aqqk&Ky. /w>kHZ^F\|pY?jWp86((q_~<:2F~ [TRUNCATED]
Feb 12, 2025 16:34:27.791004896 CET	167	IN	Data Raw: 77 a2 20 a2 ee 00 bc 00 0e 3f 80 6a e2 6b e0 1f f0 ab 35 4a 69 9a 8f 1a ef bc c3 d5 00 75 1c f3 a6 70 b8 ea 30 1e e2 60 0b 0e f4 51 13 07 05 d7 51 5d 83 24 4d c8 4d f3 76 e8 02 3f 27 de e8 2d 9c df c2 f9 57 0e e7 3a e2 ba cd db 7b 1a a0 08 f8 24 Data Ascii: w ?jk5Jiup0`QQ]$MMv?'-W:{$'NpNI+1aM5Kxcq!S{99swogP}/Mo

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2025 16:34:27.824184895 CET	1034	OUT	GET /js/fingerprint/iife.min.js HTTP/1.1 Host: dyetui.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 12, 2025 16:34:28.438802958 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 12 Feb 2025 15:34:28 GMT server: Apache last-modified: Tue, 22 Oct 2024 03:25:40 GMT etag: "85c0-6250852d63500-gzip" accept-ranges: bytes vary: Accept-Encoding content-encoding: gzip content-length: 14345 content-type: application/javascript connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 5b 57 e3 c8 96 e6 7b af d5 ff c1 28 ab b3 a4 44 36 92 2f 24 98 54 b1 80 e4 96 05 24 09 24 90 76 f9 70 64 29 b0 95 e8 e2 d2 c5 60 12 cf 5f 98 df d0 f3 3a 0f 33 8f fd 34 0f a7 57 ff af f9 76 84 6e 36 86 aa 3a 6b 1e e6 9c 2c 2c 45 ec 88 d8 11 b1 63 df 22 62 6b e5 dd bb 7f fd 97 ca bb ca 9e e3 0f 58 38 0a 1d 3f fe 74 5e 19 37 6a cd 9a 56 a9 56 76 82 d1 24 74 06 c3 b8 22 5b ca 2c 90 5a 39 f4 2d b5 52 d7 ea 8d 8a 3c 8c e3 51 d4 5e 59 b9 2d 20 6a 56 e0 29 bc ee 23 c7 62 7e c4 ec 4a e2 db 2c ac c4 43 56 39 3e bc 10 85 50 e6 fe fe be 16 8c 00 11 24 a1 c5 6a 41 38 58 71 45 89 68 c5 73 e2 6a fa 52 1b 0d 47 4a 25 7b a1 8a 79 e5 17 43 27 aa 44 c1 6d 7c 6f 86 ac 62 05 7e 6c 3a 7e 84 07 9b 55 6e c3 c0 ab 50 d5 55 51 77 65 14 06 df 99 15 47 6d 5e f4 38 09 bd 24 3c 30 a3 61 a3 d2 9f 54 7e 35 43 d3 af 1c 4d 02 14 cf 3b 34 70 e2 61 d2 a7 be ac dc 51 be 4b d9 2b 5e 51 b2 f6 3d e2 bd 5c f9 d7 7f 19 9b e1 ec 10 19 b7 89 6f c5 4e e0 cb 4c f9 21 25 11 ab 44 71 e8 58 b1 b4 41 a0 7e 91 ad [TRUNCATED] Data Ascii: }[W{(D6/$T$$vpd)`_:34Wvn6:k,,Ec"bkX8?t^7jVVv$t"[,Z9-R<Q^Y- jV)#b~J,CV9>P$jA8XqEhsjRGJ%{yC'Dm\|ob~l:~UnPUQweGm^8$<0aT~5CM;4paQK+^Q=\oNL!%DqXA~Y>>Ezp2/qTs?p#^^V2P9\7)i8'#V{48f+j}+n3\|Q6RTkhNU+J,38a-v/OOrlr@5C]Dk>{@m240_O60-F?Mbm%%QYj)DC#L<=u{P$\|FJ5mkj1mAW)91gejmxUdLU)kI2\|4`vcYhA[@DSE57Jb9\|<}n(_0KmVM7d=f%1YMR67LBTGEu6"@6Z{u"b))mAH]Pu^#%!PV-+UA[=#L0v`X}n'4iNoS5^.BYA&-j`$cjD4
Feb 12, 2025 16:34:28.438819885 CET	224	IN	Data Raw: b5 d9 ad 99 b8 71 1b 23 47 9d 15 40 2a ef b6 60 33 bf 68 18 9c 6e f6 56 c5 10 3c 3d ad 2e 19 86 18 fe 7a fa a4 60 62 0d 2d af 76 8a ea 1a 46 06 24 2f 05 4f 4f 84 e7 2f 01 7f a7 c7 0f 41 b7 c1 4b 89 ae f0 6e 88 11 a1 b2 ab 79 d9 34 ff 03 91 7d 01 Data Ascii: q#G@`3hnV<=.z`b-vF$/OO/AKny4}Moj>T"(g@=5$BA``6\|UMzm9lZR2O(+Z:t*w-TV@WryQpS\|07%,!@!gl9)I
Feb 12, 2025 16:34:28.438833952 CET	1236	IN	Data Raw: 6d 26 10 40 cd 58 55 e1 73 89 00 d9 e8 63 0c a8 8e d7 2a 28 f3 3e 53 f0 be 42 38 54 52 b1 50 62 b0 71 9e 1f b1 f8 c2 f1 58 90 c4 72 ac 52 c1 19 3e ca c5 85 80 5c 5a 62 6f df 2e e0 65 8c 73 e8 19 99 41 cd 13 7b e0 ec d7 60 98 5d 07 2d 6e c6 82 97 Data Ascii: m&@XUsc(>SB8TRPbqXrR>\Zbo.esA{`]-nKyISV_yqF</BsLcV-kJ\Bp@dxG3f54H}#FRJ_x9nS5!gzJPuCIi-/;*YE
Feb 12, 2025 16:34:28.438879967 CET	1236	IN	Data Raw: 19 65 98 b7 01 f7 df ce f4 55 f2 58 14 99 03 26 c1 9a 67 50 90 7e a4 ef e8 79 51 cf 65 51 4f 61 22 2f e5 b5 14 80 57 99 71 4a 58 3a 99 3f fa 8e 4d 60 48 29 b5 5b c7 8d 59 b8 c8 42 5e 9a 1d c6 cc 01 11 93 79 99 ab 25 dc 45 bd bc 1c 2b 18 3f d6 8d Data Ascii: eUX&gP~yQeQOa"/WqJX:?M`H)[YB^y%E+?{4z8-ih,S9d~l,D-&;HJ%Z,2!o3<Xu^&(S7F^F$er6?Aruv0./^KZ<f.(
Feb 12, 2025 16:34:28.438891888 CET	1236	IN	Data Raw: 5d 96 f4 12 a1 85 2c e9 30 b9 4b c3 12 90 22 43 7a de 86 5b 0b 7c 58 9e b6 61 aa f4 c8 35 cf 99 23 3d 1c 94 26 6d ba 21 8c 25 57 ac d3 0d 07 3d 8b b3 23 35 b2 64 3b d1 c8 35 27 12 34 12 37 b0 ee f0 eb 90 14 01 0f 8a 25 da 64 1e 05 91 43 75 1a 12 Data Ascii: ],0K"Cz[\|Xa5#=&m!%W=#5d;5'47%dCuM i9FO.9}u!fD(E9!t736j$n]Gbj2w`+k^mOOd:K$4{edSlxcn7e]TpNap(zeZ9k:
Feb 12, 2025 16:34:28.438904047 CET	672	IN	Data Raw: 87 b0 a9 a1 27 d0 aa 39 51 4f 0b d0 c7 dc 58 20 55 37 53 7c 67 8f d9 e6 d2 f3 34 83 9d f7 91 19 1f 61 63 ec 42 bc 6c 9e 1a 25 0d 85 a9 f5 96 a6 29 6d f9 c4 f0 d5 d3 d4 e9 06 11 44 aa e4 54 5e ec 26 64 7f e4 23 7c 51 39 f7 73 e5 dc 5f ec 8f db 85 Data Ascii: '9QOX U7S\|g4acBl%)mDT^&d#\|Q9s_RDr2D)6,MrIc0`}<U6%cm\bhkt?S8j>g#Pi0,q~1Zz:p<Y{."U;v<T9x/9M?3hT Mok\F\:k
Feb 12, 2025 16:34:28.439019918 CET	1236	IN	Data Raw: e4 0c 63 91 37 27 cc bd 39 61 e1 cd 09 6b c5 68 90 a3 af 16 b3 87 78 47 f8 03 0c c9 f3 8e ef af 8e 5c e7 50 fb fc 56 97 e6 b8 9b 0f 19 32 85 e1 b0 05 7a 19 c9 16 b8 61 99 46 8a 9d 6a be 41 58 56 1a f8 e6 b4 28 b5 68 7f 73 e1 51 08 4b 96 66 8d 7a Data Ascii: c7'9akhxG\PV2zaFjAXV(hsQKfzjJe_OUaG}zf<Ac6ya-VVAgIF!q6^9iun\| ^n}$r)'V&F~NXrOcfJfdd909!d0J
Feb 12, 2025 16:34:28.439032078 CET	1236	IN	Data Raw: be 11 fb 85 7a b1 fc ea 2e 78 b7 eb da 3a 38 26 b8 65 a9 ed b3 24 12 9c f1 15 26 db d9 69 45 9d eb b3 b8 c3 49 b7 f5 bd 5f d7 ca 83 e1 7f 72 bf d5 1f 86 fd ab 5d 8e 1c 31 0e c7 06 d7 00 4e f5 94 af 11 6e 00 ed ec bb f5 ab ba 7b 47 0d 7c b9 3a db Data Ascii: z.x:8&e$&iEI_r]1Nn{G\|:7XI\c8y&/3K< _3d3gzs}qq]5`)<`v4[q\|GJZJ8T{s{F(;:e2HRbM,q!Mu7OJ=aA
Feb 12, 2025 16:34:28.439052105 CET	1236	IN	Data Raw: cc 7a 0e fc cd f3 45 25 ce d1 2a 96 10 8c 84 bd c7 c3 bd 32 74 2b b2 77 84 6d cc a2 38 f0 33 31 f2 a5 c4 33 0b 32 dd 1e b2 8b b3 09 08 4e c7 da 79 3c fe fe 05 2b ef 6b 3e 44 b7 a6 df 0f 26 65 73 53 7a 73 cb 98 4d c2 b6 1a 9b 7d 89 b3 c2 3e 54 16 Data Ascii: zE%2t+wm83132Ny<+k>D&esSzsM}>Tgnp_5Ck0}i;K-Er#+t +19K2bgZ&VKbBzzu'U~/tQnR?DY8q`-"IudNM:UYTCFNXU(M%72
Feb 12, 2025 16:34:28.439064026 CET	1236	IN	Data Raw: 0e a6 b3 43 22 f3 14 2c 42 78 1d 60 b7 21 17 8c c8 62 c3 c0 b5 49 99 e1 29 7a fd e5 4d 19 52 8b 9d 16 ec df d6 9d 89 f1 3c 02 05 fe 81 cb 80 5b 4d 3a 84 24 ac d0 eb 43 92 09 df cd fd 8e de 77 40 c3 3b 98 ab ab b3 11 f7 19 ef fc a1 a7 46 98 25 1a Data Ascii: C",Bx`!bI)zMR<[M:$Cw@;F%U)r/HR$7'!Q&`nT%4_@Y1^,%u ;&-X#q}4G;y*8{0:@10s>8`
Feb 12, 2025 16:34:28.444484949 CET	1236	IN	Data Raw: d4 17 a7 f3 2c 7e 8c 3d bf 77 de 98 e6 21 1c aa d9 75 61 3a b8 ec cb ba da 62 0d b5 d9 d4 35 4d e1 47 0c c5 94 7d 8e 2c c7 75 c9 a8 e6 67 d9 c4 46 74 4c ee 03 f2 9d d3 d9 be 90 fd 9e d0 65 1b 11 f6 d9 d0 59 73 ee 00 e2 47 71 14 34 a2 cd 0f 70 95 Data Ascii: ,~=w!ua:b5MG},ugFtLeYsGq4pWP8j jw>KMzMt<0M.MeiJR3:x/18ABW),354:GFhm-KOeeciI/D#S&K/1)]Xd)$[M

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2025 16:34:28.551397085 CET	1080	OUT	GET /favicon.ico HTTP/1.1 Host: dyetui.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 12, 2025 16:34:29.164925098 CET	170	IN	HTTP/1.0 403 Forbidden cache-control: no-cache content-type: text/html Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2025 16:34:28.556865931 CET	289	OUT	GET /js/fingerprint/iife.min.js HTTP/1.1 Host: dyetui.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 12, 2025 16:34:29.140763044 CET	1236	IN	HTTP/1.1 200 OK date: Wed, 12 Feb 2025 15:34:29 GMT server: Apache last-modified: Tue, 22 Oct 2024 03:25:40 GMT etag: "85c0-6250852d63500-gzip" accept-ranges: bytes vary: Accept-Encoding content-encoding: gzip content-length: 14345 content-type: application/javascript connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 7d 5b 57 e3 c8 96 e6 7b af d5 ff c1 28 ab b3 a4 44 36 92 2f 24 98 54 b1 80 e4 96 05 24 09 24 90 76 f9 70 64 29 b0 95 e8 e2 d2 c5 60 12 cf 5f 98 df d0 f3 3a 0f 33 8f fd 34 0f a7 57 ff af f9 76 84 6e 36 86 aa 3a 6b 1e e6 9c 2c 2c 45 ec 88 d8 11 b1 63 df 22 62 6b e5 dd bb 7f fd 97 ca bb ca 9e e3 0f 58 38 0a 1d 3f fe 74 5e 19 37 6a cd 9a 56 a9 56 76 82 d1 24 74 06 c3 b8 22 5b ca 2c 90 5a 39 f4 2d b5 52 d7 ea 8d 8a 3c 8c e3 51 d4 5e 59 b9 2d 20 6a 56 e0 29 bc ee 23 c7 62 7e c4 ec 4a e2 db 2c ac c4 43 56 39 3e bc 10 85 50 e6 fe fe be 16 8c 00 11 24 a1 c5 6a 41 38 58 71 45 89 68 c5 73 e2 6a fa 52 1b 0d 47 4a 25 7b a1 8a 79 e5 17 43 27 aa 44 c1 6d 7c 6f 86 ac 62 05 7e 6c 3a 7e 84 07 9b 55 6e c3 c0 ab 50 d5 55 51 77 65 14 06 df 99 15 47 6d 5e f4 38 09 bd 24 3c 30 a3 61 a3 d2 9f 54 7e 35 43 d3 af 1c 4d 02 14 cf 3b 34 70 e2 61 d2 a7 be ac dc 51 be 4b d9 2b 5e 51 b2 f6 3d e2 bd 5c f9 d7 7f 19 9b e1 ec 10 19 b7 89 6f c5 4e e0 cb 4c f9 21 25 11 ab 44 71 e8 58 b1 b4 41 a0 7e 91 ad [TRUNCATED] Data Ascii: }[W{(D6/$T$$vpd)`_:34Wvn6:k,,Ec"bkX8?t^7jVVv$t"[,Z9-R<Q^Y- jV)#b~J,CV9>P$jA8XqEhsjRGJ%{yC'Dm\|ob~l:~UnPUQweGm^8$<0aT~5CM;4paQK+^Q=\oNL!%DqXA~Y>>Ezp2/qTs?p#^^V2P9\7)i8'#V{48f+j}+n3\|Q6RTkhNU+J,38a-v/OOrlr@5C]Dk>{@m240_O60-F?Mbm%%QYj)DC#L<=u{P$\|FJ5mkj1mAW)91gejmxUdLU)kI2\|4`vcYhA[@DSE57Jb9\|<}n(_0KmVM7d=f%1YMR67LBTGEu6"@6Z{u"b))mAH]Pu^#%!PV-+UA[=#L0v`X}n'4iNoS5^.BYA&-j`$cjD4
Feb 12, 2025 16:34:29.140789032 CET	224	IN	Data Raw: b5 d9 ad 99 b8 71 1b 23 47 9d 15 40 2a ef b6 60 33 bf 68 18 9c 6e f6 56 c5 10 3c 3d ad 2e 19 86 18 fe 7a fa a4 60 62 0d 2d af 76 8a ea 1a 46 06 24 2f 05 4f 4f 84 e7 2f 01 7f a7 c7 0f 41 b7 c1 4b 89 ae f0 6e 88 11 a1 b2 ab 79 d9 34 ff 03 91 7d 01 Data Ascii: q#G@`3hnV<=.z`b-vF$/OO/AKny4}Moj>T"(g@=5$BA``6\|UMzm9lZR2O(+Z:t*w-TV@WryQpS\|07%,!@!gl9)I
Feb 12, 2025 16:34:29.140810966 CET	1236	IN	Data Raw: 6d 26 10 40 cd 58 55 e1 73 89 00 d9 e8 63 0c a8 8e d7 2a 28 f3 3e 53 f0 be 42 38 54 52 b1 50 62 b0 71 9e 1f b1 f8 c2 f1 58 90 c4 72 ac 52 c1 19 3e ca c5 85 80 5c 5a 62 6f df 2e e0 65 8c 73 e8 19 99 41 cd 13 7b e0 ec d7 60 98 5d 07 2d 6e c6 82 97 Data Ascii: m&@XUsc(>SB8TRPbqXrR>\Zbo.esA{`]-nKyISV_yqF</BsLcV-kJ\Bp@dxG3f54H}#FRJ_x9nS5!gzJPuCIi-/;*YE
Feb 12, 2025 16:34:29.140824080 CET	1236	IN	Data Raw: 19 65 98 b7 01 f7 df ce f4 55 f2 58 14 99 03 26 c1 9a 67 50 90 7e a4 ef e8 79 51 cf 65 51 4f 61 22 2f e5 b5 14 80 57 99 71 4a 58 3a 99 3f fa 8e 4d 60 48 29 b5 5b c7 8d 59 b8 c8 42 5e 9a 1d c6 cc 01 11 93 79 99 ab 25 dc 45 bd bc 1c 2b 18 3f d6 8d Data Ascii: eUX&gP~yQeQOa"/WqJX:?M`H)[YB^y%E+?{4z8-ih,S9d~l,D-&;HJ%Z,2!o3<Xu^&(S7F^F$er6?Aruv0./^KZ<f.(
Feb 12, 2025 16:34:29.140836954 CET	1236	IN	Data Raw: 5d 96 f4 12 a1 85 2c e9 30 b9 4b c3 12 90 22 43 7a de 86 5b 0b 7c 58 9e b6 61 aa f4 c8 35 cf 99 23 3d 1c 94 26 6d ba 21 8c 25 57 ac d3 0d 07 3d 8b b3 23 35 b2 64 3b d1 c8 35 27 12 34 12 37 b0 ee f0 eb 90 14 01 0f 8a 25 da 64 1e 05 91 43 75 1a 12 Data Ascii: ],0K"Cz[\|Xa5#=&m!%W=#5d;5'47%dCuM i9FO.9}u!fD(E9!t736j$n]Gbj2w`+k^mOOd:K$4{edSlxcn7e]TpNap(zeZ9k:
Feb 12, 2025 16:34:29.140860081 CET	1236	IN	Data Raw: 87 b0 a9 a1 27 d0 aa 39 51 4f 0b d0 c7 dc 58 20 55 37 53 7c 67 8f d9 e6 d2 f3 34 83 9d f7 91 19 1f 61 63 ec 42 bc 6c 9e 1a 25 0d 85 a9 f5 96 a6 29 6d f9 c4 f0 d5 d3 d4 e9 06 11 44 aa e4 54 5e ec 26 64 7f e4 23 7c 51 39 f7 73 e5 dc 5f ec 8f db 85 Data Ascii: '9QOX U7S\|g4acBl%)mDT^&d#\|Q9s_RDr2D)6,MrIc0`}<U6%cm\bhkt?S8j>g#Pi0,q~1Zz:p<Y{."U;v<T9x/9M?3hT Mok\F\:k
Feb 12, 2025 16:34:29.140875101 CET	1236	IN	Data Raw: f5 f3 c5 d6 f6 d1 6e 97 6b c5 86 a4 37 35 b0 cc 1e d6 fa 1b f0 c7 ad 81 39 74 38 ce 87 a8 fd d8 5d 1f f5 bd 07 fc f7 b5 3c 16 57 66 e8 c3 60 3c 23 e5 c4 74 a9 31 d3 e6 aa 45 75 18 f8 6c 32 0a c8 40 ac a5 69 2c ac 86 81 48 b9 1f dd a4 89 37 36 8b Data Ascii: nk759t8]<Wf`<#t1Eul2@i,H76t!tZ;1 uSh'fho~0!#gUgvl[Czd>TmD%`x;,=F7{fTWB.Oi0V{iZu=
Feb 12, 2025 16:34:29.140887976 CET	552	IN	Data Raw: d8 35 c0 4e ef ad fd cb 09 5f 42 89 70 72 9b 6e 3f 78 d8 fa 78 b9 fd f9 5a 6b e4 92 ce 06 2b 00 8f 7f 84 5c 72 fb fe 97 f8 e4 f1 b0 c9 3e de dd e7 f5 0b b6 90 77 b0 40 8d c4 bf 39 c3 1a b8 10 87 8c c2 60 8e d8 c1 a5 cb a5 e6 73 fe c5 71 b3 75 12 Data Ascii: 5N_Bprn?xxZk+\r>w@9`squGvzOLY{~+pRz4s6[ydR_sqn/pHi#S,k`ds6VBiQUAsu5<wQT[isk5n2f
Feb 12, 2025 16:34:29.140902042 CET	1236	IN	Data Raw: 0e 4e 5c cb ef c0 40 6a 61 04 f5 e8 4f 96 22 7d 6d df 1d 32 d8 cf d0 db 88 8d 24 16 6c 72 8c fd a8 cc 65 b3 fe 1f 51 00 24 08 70 c1 5a 0a da 5f 7f bc 6e 9c 61 d6 b6 87 d6 fd f3 95 81 dc 7a 4b 87 e9 3b ee ec af a7 5a 9c 79 a5 fb 57 f5 bd c8 fe a8 Data Ascii: N\@jaO"}m2$lreQ$pZ_nazK;ZyW9_CYGyk/PA;zE%*2t+wm83132Ny<+k>D&esSzsM}>Tgnp_5Ck0}i;K-Er#+t
Feb 12, 2025 16:34:29.140916109 CET	1236	IN	Data Raw: 35 73 c4 4f 8e 1e d7 75 28 67 50 52 c9 91 72 e2 0a b5 36 45 7e 2f 5c ec 77 12 ba 07 6c 2b 1d 22 a1 33 ec 10 83 17 2a 6a 09 37 b2 16 c8 d6 84 b0 18 71 07 52 83 fc 50 43 a8 39 27 41 67 61 0f ec fa a5 d3 27 07 cf d5 6e d2 f1 0f b1 04 4f 7c f3 5c 77 Data Ascii: 5sOu(gPRr6E~/\wl+"3*j7qRPC9'Aga'nO\|\wfn"1U~<v+Z5gF]MC",Bx`!bI)zMR<[M:$Cw@;F%U)r/HR$7'!Q&
Feb 12, 2025 16:34:29.145847082 CET	1236	IN	Data Raw: bd 9e 41 8d d6 06 2c de a6 d0 32 8e 3f d8 71 e9 52 eb 19 4a cb 8a 58 54 d9 91 ac 90 af 74 33 b1 9d a0 3d 7f ba a8 b8 3a ce 6a 9f 6f 6f 69 cb 6f 8b 00 f9 90 3e 94 6e eb 2e c8 e4 77 96 b2 8b b8 d5 3a bd f2 45 b5 b4 c3 ff be d0 54 f9 8a 2e b8 3d 21 Data Ascii: A,2?qRJXTt3=:jooio>n.w:ET.=!L)^_lZJ,t`~$,~=w!ua:b5MG},ugFtLeYsGq4pWP8j jw>KMzMt<0M.M

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2025 16:34:29.031166077 CET	1922	OUT	GET /f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=a3db7cd464228025d120ca597c81b5f2 HTTP/1.1 Host: dyetui.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 12, 2025 16:34:29.617022038 CET	1188	IN	HTTP/1.1 200 OK date: Wed, 12 Feb 2025 15:34:29 GMT server: Apache vary: Accept-Encoding content-encoding: gzip content-length: 989 content-type: text/html; charset=UTF-8 connection: close Data Raw: 1f 8b 08 00 00 00 00 00 00 03 95 95 5b 6f db 36 14 c7 df 0b f4 3b 08 19 b6 b4 33 16 53 92 5d cc 6d dc a1 ae 2e 8e 6c 31 b1 4c 52 16 5f 06 8a 94 23 c9 d4 a5 12 e3 5b bb ef 3e 3b 4e 81 dc 1e 36 be 08 fa 93 bf a3 3f 75 78 78 2e 53 55 c8 cf 6f df 5c a6 09 13 c7 a7 ca 94 4c 3e 0b 51 b5 6d c2 9b 44 b5 17 bc 2a 2e bb 27 f9 30 df f2 26 ab 95 a6 76 75 32 3c 53 c9 56 75 73 b6 66 27 f5 ec b0 60 cd 1a ad 49 44 d6 24 5c fd 2d b3 72 a5 0d b5 f3 54 a9 fa 63 b7 2b 76 89 ba cb 8e 01 bb 4b e3 a2 4e eb bf 92 21 90 8b 7e 38 5d 0a 16 58 6e 3e 9e 85 30 66 4b b7 ec 0d 96 32 0d 26 3a ac b9 5b 83 39 f0 9b 68 45 00 77 3c 28 40 4d 84 a1 6a e4 78 1e 05 5e 3e dd 29 9f 3b b0 f2 89 83 90 5d e7 c8 72 74 96 c3 2d 2a e5 58 94 fe 6e 0a 5a 43 00 69 33 bd fe 1a 94 bc 09 4b aa 08 5e f5 b0 2e af 45 21 10 95 32 82 ee 46 a7 21 06 f1 e2 16 44 87 e8 c2 ed 99 5c 7a fd c8 94 64 62 78 0c b9 5b 46 0c 1a 90 32 ea 93 62 1b 20 63 f0 2d 2c 1d 10 60 18 46 fb f4 3a 91 b7 7d 6a d6 25 cf 05 89 f3 f4 e6 7a 81 d7 10 f3 fd b5 25 54 88 b7 db 39 ee a7 d0 1e [TRUNCATED] Data Ascii: [o6;3S]m.l1LR_#[>;N6?uxx.SUo\L>QmD.'0&vu2<SVusf'`ID$\-rTc+vKN!~8]Xn>0fK2&:[9hEw<(@Mjx^>);]rt-XnZCi3K^.E!2F!D\zdbx[F2b c-,`F:}j%z%T9ss-` )#+1vjd{F{xA/}:0LLnBx1j9C:Y=?I X;zf$Bn5wfflo[JL3c;=nb\[&%5-E6whIM$xBreLLlQqFq@KC@z:#@@ ^\U}uC1P\Q]_W&#)_\|@rpnQDs'^8S#sTgdX"!svYD[plz-SFq!/=H%FW:tu{,JQm.L0:8nS,LbIh}V>x.x&[{Fjz}O?/%\|}S>OG^{ys['u_3_o3UEKn;S>S8WbU3<ey?c8qvOWSO6

Timestamp	Bytes transferred	Direction	Data
Feb 12, 2025 16:34:29.668453932 CET	2028	OUT	GET /f2.php?e=0lX5WLfdaRDGjHQWNbafGn49flhRK1NpcGp0S0MrYkV0cFJNd0pVd2tpTFJJZ0JjLytMcFNoMVFTTEpjTDF1ajNxTnlHdnMyL0s2d0lEa1pCRncrWnZtVUk4U1lOdmdTZllYNGw1ZWU0bXg0YVd2dG43clJ5Y3lVK2JaTGxaV2ZRVnY5VmxRT29qWnF0RUNWYzhOelg5Z3pncjdVbjhPOXUvNUczODdtWUxxSU5hNE9pS2JPQkZDUjVvbDVFUGNhZmVhaVBIUzdDV2RsL3BlR1JrazE2WG5mMFp4UXZ0SEw4dEx6c1A5M3Z1czBUVUt0K3c3N3czNHBYaUtpMGZtYUZocjU5N05iek9oaUthSnZsMWtsaDZIbjJFanJMSlBYTG5KRlJRRktuTjkraWJNT0VtQVo5VTdWc3lvcFQ3b2tqc3dLSGpvZkdKU3R3Q2xLRmVJNzUrbUpDaEVnZHdvZndiSFZhYlZNbStETEZpeWpDbHMyTEJQWVI2K3FscmllN0xudERWUFptUDdDbnYrR1dTcThYbmFNU0NGZWd4N29PMUJwcVpmT1hQV016ZGRiN0RjczdITkpPNVZGOWZvbUVDMmU1SWdIZ28wZXlnMXRDVlpCalY2a1haQy9CdGFjbXV6T2d0VnZDZTZjdW0rVHdKMVJrN0Q2SWdzZThSY3BmdFBDVVFDYTVFNHhWaGN1Ty9QbFYxaTRSdFZQL3Z1ZnhVWHJrdGZacEFBT1AvMmRzNWhuQ0hlcEM4VW1yUT0%3D&vs=1280:907&ds=1280:1024&sl=0:0&os=f&nos=f HTTP/1.1 Host: dyetui.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Referer: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy&fp=a3db7cd464228025d120ca597c81b5f2 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Feb 12, 2025 16:34:30.292515993 CET	291	IN	HTTP/1.1 302 Found date: Wed, 12 Feb 2025 15:34:30 GMT server: Apache location: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5 content-length: 0 content-type: text/html; charset=UTF-8 connection: close

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:32:45 UTC	685	OUT	GET /LexipolLeaks/Lexipol.7z HTTP/1.1 Host: data.ddosecrets.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:32:45 UTC	873	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:32:45 GMT Content-Type: application/x-7z-compressed Content-Length: 32920929285 Connection: close Last-Modified: Thu, 06 Feb 2025 13:58:44 GMT ETag: "67a4c014-7aa3d8405" Cache-Control: max-age=14400 CF-Cache-Status: MISS Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EDruFvqBXLiS5bcjUb4V3VeYK9fFUE2v2v0DQNTAbHHMU7WcHObkjn%2FDoWdNKJ0VrAR9z6G6dyOib8mwAUPdUcC5D%2FwnTKHaKQ3kfR634%2FAdOvPZin%2FOJi8Qwwdvr%2BvIdi%2Bv7Iw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 910da216e8a2c402-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1557&min_rtt=1545&rtt_var=604&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2832&recv_bytes=1263&delivery_rate=1773997&cwnd=176&unsent_bytes=0&cid=f31b98305de4e959&ts=474&x=0"
2025-02-12 15:32:45 UTC	496	IN	Data Raw: 37 7a bc af 27 1c 00 04 76 1f 2d ff bc 83 3d aa 07 00 00 00 29 00 00 00 00 00 00 00 92 4e 07 94 e2 73 99 e0 03 5d 00 12 94 04 84 70 ad a4 c7 27 70 66 4d 34 65 03 c3 c3 98 46 54 f1 94 09 ea 02 f9 13 a6 02 1a cc db bb 20 38 49 d6 9c ab da 7f 78 c9 97 d0 10 60 00 db 0a f6 70 82 dc 20 56 0f 31 69 2c dc 55 6c f8 63 02 f2 1f e1 ed 5e c2 04 8a de af ea d3 b9 e9 a7 5c b0 a9 23 4f 3d 0b 56 13 84 01 2b 81 e7 9f 29 97 7b a0 e7 4d 2b d5 b5 63 3f dc 20 c4 bf 17 13 fa bb bc 71 03 ab e9 fa c8 ce 16 fc 07 69 ef 6d 44 1a 50 15 6b 29 ff f3 54 90 52 05 a3 aa be 62 0a fa 9f 01 05 6e a3 21 58 57 b3 c1 9d 2d 09 c7 59 9b 54 d6 07 a4 b3 55 8e 87 43 ff 15 4e bb 5e 8e 68 30 a7 33 1a 64 71 c7 c1 3e 08 9d 12 2c b1 07 11 31 15 fa 12 8d 96 b9 60 c2 b0 4a e0 ce 03 6a e0 8b de c5 1d 5a Data Ascii: 7z'v-=)Ns]p'pfM4eFT 8Ix`p V1i,Ulc^\#O=V+){M+c? qimDPk)TRbn!XW-YTUCN^h03dq>,1`JjZ
2025-02-12 15:32:45 UTC	1369	IN	Data Raw: f7 da a6 81 34 56 c0 12 dc 95 2e 2e f6 d3 5f 77 84 b0 26 31 3e d1 2d f1 eb d6 91 a4 9e 2d 27 69 ff fe 52 f8 00 43 64 c2 c4 72 e4 d5 ea 86 86 e6 ce 4c 97 65 d5 9b a6 2f fd fd 96 ab 84 50 d9 95 3b 22 df d9 50 e0 27 cc 3d 12 f8 7b f7 67 79 c4 eb 43 63 92 95 54 da b2 86 6c 7d f5 24 62 be da f8 27 9f 0c a6 bb 64 2f ab 4b 54 09 e1 3d c2 35 95 48 37 cf 81 b1 62 59 e9 14 9c 38 74 29 b5 23 3d 30 fb da 1d 5a 91 a5 c0 fe f5 1d a1 26 b5 81 83 63 b1 e4 99 5e ef 08 d5 c5 f6 24 61 2a 80 e5 32 a6 4e 2b 02 7d c7 35 12 6b 72 57 5f 00 82 80 25 29 67 58 49 5b 53 97 55 31 dc 2d f9 8d 57 a8 ad c7 1a f5 a8 a6 7f 7f af c8 72 dd 48 36 fa 64 95 6a 50 bb b1 e8 83 79 46 7a d6 7a 6a a0 28 ca cb 13 86 c2 3e 94 b9 74 d4 84 24 d7 83 df 99 e3 b3 ab 2d 4e 56 7a 62 8b 12 e2 ce 52 a6 4e e9 Data Ascii: 4V.._w&1>--'iRCdrLe/P;"P'={gyCcTl}$b'd/KT=5H7bY8t)#=0Z&c^$a*2N+}5krW_%)gXI[SU1-WrH6djPyFzzj(>t$-NVzbRN
2025-02-12 15:32:45 UTC	1369	IN	Data Raw: 22 1e 59 34 d0 f1 4d ca ce ac e1 bf e6 81 0a e4 6c 8c 2f 1c 66 62 81 35 44 c4 03 b3 e4 4f bf 00 9d 15 2f ae 4e 1b 72 8a 2c 34 91 da a6 69 7e 95 83 93 ff c1 0d 18 e3 b9 7e 65 98 d1 cb f4 01 dd ef cf 43 cd 03 5d f0 d2 43 2c 55 7d c2 0f 5c c3 55 01 92 7b 98 c4 fe cf 41 14 c0 09 9b 03 55 e2 c5 5a df b3 07 3e 21 48 52 86 36 20 0d 19 a0 d4 7c 55 d0 c2 d8 87 7b 3c ad 86 62 0b e8 e1 5e c1 63 fc dd cf 8f 6b 8c 04 db 99 44 35 e1 de ed 73 b3 81 d5 89 8f e2 f1 e0 f0 ed d7 98 f3 90 a0 e6 01 55 ec fb d0 09 6d 0d 58 02 70 f0 b4 7c 6c a5 95 6f ea 76 64 df 72 c9 90 45 59 04 65 b8 16 49 18 4e aa 4d 8c f9 87 1c 56 f3 01 1f d2 8a 33 2a 8b 09 aa f4 d4 20 b5 c8 88 6b 80 9c fd a4 f0 41 37 21 9c dc d4 aa 3b f2 cb 70 25 dc f4 9d 3e e7 ce b2 fe 35 72 30 42 28 82 6b e7 1b 72 1a fb Data Ascii: "Y4Ml/fb5DO/Nr,4i~~eC]C,U}\U{AUZ>!HR6 \|U{<b^ckD5sUmXp\|lovdrEYeINMV3* kA7!;p%>5r0B(kr
2025-02-12 15:32:45 UTC	1369	IN	Data Raw: 28 e0 ca 89 65 03 5f 80 f5 05 b4 45 61 04 bf ae 2f 1e 91 94 2e 29 3d aa d4 11 0a 5b d7 94 5c 31 2f 9c 9c cf d0 04 b0 e5 ea 53 fa 33 4f 1d b9 58 ba 00 a3 a2 cc 04 90 bf bd 4f 7d 86 23 e1 e4 00 48 03 4e c6 84 c2 d0 fd a6 43 9f 92 41 88 46 42 38 82 52 ca 32 15 99 f8 c4 c7 9f 69 76 e2 0b 74 1c 3d dd 0a f2 aa eb ad 6a cf 9d 3c 5f be ff a0 df 1d e4 e4 50 46 6f 0e bc 56 6c b1 d6 9b 8d c7 17 36 37 20 26 17 f8 b3 c1 ed 76 ee f9 bf 20 0d 56 8f bf 20 7f 62 f5 fd c5 c3 2b e2 88 d0 07 ca 27 38 4e 8e d0 f0 85 89 1c 6a be 92 dd 40 c1 65 85 93 80 93 41 cb be 40 58 a7 70 3e 84 1f f1 e6 0d 2b d4 06 ac fb 02 d4 a9 2c 49 da 68 dc 58 86 8b 18 fd 09 d8 80 6b e9 81 d6 b3 03 ad fb 89 15 b5 2d a1 33 7f ea 55 03 eb a6 00 69 86 94 36 3b f9 62 bd 0e b2 08 fc 67 42 5e 8d 7e 73 1d 03 Data Ascii: (e_Ea/.)=[\1/S3OXO}#HNCAFB8R2ivt=j<_PFoVl67 &v V b+'8Nj@eA@Xp>+,IhXk-3Ui6;bgB^~s
2025-02-12 15:32:45 UTC	1369	IN	Data Raw: 60 02 f2 7e d8 ae 11 71 8a 0a 6a 6a b6 84 62 6c 6d 7d b6 06 36 2c 17 44 c4 92 01 bd 2c 84 5a a4 b4 db 10 5b 37 da 1e 90 21 b4 4a d5 6a db 81 cd d3 a2 86 68 aa d5 2c 15 84 14 ad 65 75 23 6e 5e 04 0c 35 c8 14 b6 f4 a5 ad fa 7c 4a 56 f0 16 b5 d4 80 0f 8d 83 fd 63 7e 9d 51 f9 91 7d ce d2 4f db 88 18 03 76 f9 e0 8a ee 46 fd b6 92 7c 75 84 24 67 73 a3 c8 b2 d4 b8 0b 4e ff 04 b5 f9 c4 a0 ee c8 03 26 21 bd 16 3a 2d 6f 81 22 0b 78 bd e5 dd be 25 1b 92 60 cf 17 46 b5 07 8a eb c1 61 80 5f 02 ac e2 a9 25 33 a2 c6 26 37 fe a1 4b 1a b1 ea 3f 59 6d c5 38 3c e9 e2 fa e2 b6 9b a8 b2 47 2e 2c dd 56 1d eb 9c 33 89 34 62 77 23 1e eb 5e f3 13 ba f5 ee 0d f4 52 62 58 bc 99 d2 17 67 d3 ed 39 9b 28 b2 0b ce 00 8d 57 11 de df 13 fd d5 e7 54 3d 97 49 74 25 9c b3 fa 6d 65 7d 79 54 Data Ascii: `~qjjblm}6,D,Z[7!Jjh,eu#n^5\|JVc~Q}OvF\|u$gsN&!:-o"x%`Fa_%3&7K?Ym8<G.,V34bw#^RbXg9(WT=It%me}yT
2025-02-12 15:32:45 UTC	1369	IN	Data Raw: f4 7d 51 22 cf e6 cb e9 01 b0 58 c4 7b ef 32 4c a6 d2 2d 4e 0b a2 a0 15 44 1d 83 bf 83 52 ab 55 9b 58 73 82 72 73 5a 84 d4 0e b9 9d cd eb 39 af 97 d1 1d d8 de 72 a9 13 da e3 a1 78 13 7e 11 8e ad da 55 7d 0e 17 09 53 dd 83 39 a8 a3 d7 58 cb 75 21 ef 11 5d 9d 19 15 a6 75 9c f2 46 18 c9 7e 96 5b f1 7e 26 c9 f4 de 02 77 1d 8d 1d 48 78 31 be ea ea bf 09 e2 07 58 9e b4 7f 19 8e 74 2c e0 61 2f b4 fa 99 8d 67 89 0a 57 d0 6b 2b 55 68 c2 0d a2 36 3b 4c d4 c9 a0 cf b3 cb de ec 1e 5d b2 e9 77 8e 3c 2d 67 fd a8 b9 db 60 58 90 4f 59 86 1d f0 77 24 28 d4 23 6b 4e e1 05 0d a2 1d e6 11 1f cc 84 cf fc c8 fa 3c e1 3b a2 09 de 84 e7 79 e7 8e 02 65 af b9 18 2b 09 28 69 95 d2 c0 8f 33 7d 19 35 1b d8 cd 48 ff 13 3f 23 c8 ba 4b 4b 30 fe 17 d5 97 82 d2 ca f8 a8 d0 35 00 fe d9 5e Data Ascii: }Q"X{2L-NDRUXsrsZ9rx~U}S9Xu!]uF~[~&wHx1Xt,a/gWk+Uh6;L]w<-g`XOYw$(#kN<;ye+(i3}5H?#KK05^
2025-02-12 15:32:45 UTC	1369	IN	Data Raw: 4b ba a3 45 46 fc e6 3b 26 a7 88 35 da 65 99 10 4b c6 c8 ef be 45 86 24 1b e2 eb 8c 92 5e 1f 54 56 22 26 e8 51 6e eb 60 37 27 33 bc b9 17 64 0c bf 7d b6 8d 30 44 8f 9f 82 63 db 60 ca 9f a1 8e 7b 5d 36 a1 ed 7a 01 f4 0f b4 c4 1f a7 ae 1c c4 b8 5c a4 55 fe 73 12 44 4b e1 60 cf 78 eb 4d fd d0 b4 e5 72 f9 2c 70 eb 98 95 ce be 5a d0 d3 10 c3 08 57 b8 5b 72 18 e4 a1 fa 17 da df c5 89 97 37 e2 a8 b2 90 95 7a 37 4f 59 7b 4c 0d c3 00 76 3a 5f eb 07 8a 42 95 8f c1 10 4c ab 44 73 15 8a dc 56 b3 d5 da f9 99 c7 1b d5 c4 8b 01 8f 4c 1e 7b c0 a7 bd 36 ce de 8e 40 30 d0 84 fa a5 3b 2b e1 78 21 38 8a 79 7e be 2d 1b 68 95 e4 5c e7 a9 be 97 be fc 6b 52 d0 b1 70 19 fe 24 89 2f da 1b 61 98 1a 3b ba d6 09 70 b2 06 b0 a9 b0 c8 88 57 74 93 b5 10 b0 6f ac ce b0 07 3b 22 2f 5a 28 Data Ascii: KEF;&5eKE$^TV"&Qn`7'3d}0Dc`{]6z\UsDK`xMr,pZW[r7z7OY{Lv:_BLDsVL{6@0;+x!8y~-h\kRp$/a;pWto;"/Z(
2025-02-12 15:32:45 UTC	1369	IN	Data Raw: fd b7 31 1c f3 9f bd fc c2 01 fb e7 6a 3b a1 c5 7d 58 da 59 8f 7b 3a 8b 48 e2 e9 0d e9 df 8a 4f 85 0f fd 5a 09 10 8d c9 b3 cf 45 42 7a c5 3d 32 dc ee 80 14 91 1e e8 34 e1 7a 57 74 14 6c 2b 5c e5 35 00 3e 55 31 66 13 07 7f ef a6 b8 73 df 7e d4 8d 03 3b a5 79 3a 92 1c f6 7d 44 3a f9 75 a7 7d 67 c8 46 a3 81 56 09 61 96 ce 94 04 4e 9f 0f c6 79 12 5f 1b 81 ad 13 a4 5d 65 ca 48 74 e6 76 3c b7 b7 2b 74 c7 ff 35 db 70 85 20 f3 1c b1 ed e4 3a 1f 63 69 d9 e5 74 c1 96 53 fc c6 e4 64 68 1e fe 7b e7 5e b9 eb ff 3d 7f 9e a1 60 69 f5 68 c8 ac 52 12 f5 e3 d8 7b 0b 67 d9 11 3d 95 70 72 4f dd e6 f0 56 6f 6a c6 b7 b8 8f 39 e0 48 b1 5b a6 9b 1c b0 b8 fc 15 7f 94 e2 1b d9 b1 89 f3 4c 71 38 8f a0 a2 d5 1b e1 01 6d 1e 65 65 b3 90 b5 31 c1 ab 47 81 91 c5 d9 75 44 86 fd 58 59 73 Data Ascii: 1j;}XY{:HOZEBz=24zWtl+\5>U1fs~;y:}D:u}gFVaNy_]eHtv<+t5p :citSdh{^=`ihR{g=prOVoj9H[Lq8mee1GuDXYs
2025-02-12 15:32:45 UTC	1369	IN	Data Raw: e2 6f 2b 70 cd 43 8e 6c af 84 a1 b5 5e 60 2d 50 e3 23 de 99 cc 5d 42 1f 77 39 f1 c3 cc 0b 99 b1 92 64 9a e6 f0 3c 3e 22 f7 97 2b 09 81 7f ea 7d 9a 11 a6 8f 63 aa 36 3e 93 b0 06 df d2 2d 45 6d 34 f4 6c 76 5a f0 5f 1c b6 41 a6 27 4f 48 75 a0 4f 74 f7 41 99 89 70 ae 3e 82 08 72 5a 61 d2 ff d3 19 63 b8 d6 08 bc 4a 7c 7b b8 00 ab 6b 37 5e 17 8a e7 65 41 7e 40 c6 ba 44 bf 36 52 7b 0d 14 bd 0e 21 7e b2 66 13 02 d3 46 69 c8 24 b0 bc ee f7 83 8f 10 b0 d9 8b 79 b5 23 48 aa fb dc f3 0c e8 d7 7d 97 0d 8c 73 3f e7 f5 ae 1b 62 b0 08 4c f9 dd 41 ad ea 6f ba 16 ab c3 db 01 9e cd 1b bc 07 a3 1f 78 04 e6 f3 72 6e 4e 3e 87 d3 2e 89 79 37 08 b2 48 3d 95 be 44 b9 a8 a8 1d 23 57 d4 d9 6a 9d fc cf de 36 78 4e ba d1 85 b4 ed 03 28 31 99 17 dc 81 43 a5 96 a2 ed fc a2 3e 35 c1 e5 Data Ascii: o+pCl^`-P#]Bw9d<>"+}c6>-Em4lvZ_A'OHuOtAp>rZacJ\|{k7^eA~@D6R{!~fFi$y#H}s?bLAoxrnN>.y7H=D#Wj6xN(1C>5
2025-02-12 15:32:45 UTC	1369	IN	Data Raw: d5 87 a3 1b 58 1d 29 12 f3 69 89 0b b7 9f bf f8 cb a7 c0 ef c5 fd 0f a7 e8 cc 1e 01 99 3e 0a bd 30 ef d1 7f 57 48 33 49 24 ad 32 ed df 8b 6a ec 05 fd 14 b2 3b 8a 09 c7 0d a8 82 b2 fa 2b 69 28 24 d1 91 3d c2 b1 4a 0b 40 c4 23 c4 4d a9 7f 9f 36 28 ec 3d 72 37 2f b2 09 a2 41 8e 0f df 8b 29 eb 60 5c 06 19 22 db 6f 14 2e b1 43 0a fd 3b 6a 21 fc cb f0 c1 68 76 85 2f 81 bb 66 39 ac 23 63 76 30 15 32 39 7d 3c 30 07 09 9c 42 91 a7 d8 8e e4 ee 2f dc f5 df f1 0b cb f0 d5 99 b8 73 98 71 14 62 cb 5b 5f 3f 8c 3d 5c 0b 1a 50 eb 94 bf 66 d2 d3 b7 4a e6 46 2c a0 bd de a5 5a 90 f8 01 f1 98 49 00 68 4a d9 f9 fe ce d0 f5 81 ca ab 03 52 56 1b 3b 09 d6 28 df f3 48 9c 5a 21 5e df 9e bb 8e 5a ae d0 8f cb bc 17 1a 39 93 bb ce b8 f1 37 a8 95 14 3b 35 f1 c7 2f d2 4e 2a cd 1f e3 08 Data Ascii: X)i>0WH3I$2j;+i($=J@#M6(=r7/A)`\"o.C;j!hv/f9#cv029}<0B/sqb[_?=\PfJF,ZIhJRV;(HZ!^Z97;5/N*

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:32:46 UTC	550	OUT	OPTIONS /report/v4?s=EDruFvqBXLiS5bcjUb4V3VeYK9fFUE2v2v0DQNTAbHHMU7WcHObkjn%2FDoWdNKJ0VrAR9z6G6dyOib8mwAUPdUcC5D%2FwnTKHaKQ3kfR634%2FAdOvPZin%2FOJi8Qwwdvr%2BvIdi%2Bv7Iw%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Origin: https://data.ddosecrets.com Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:32:46 UTC	336	IN	HTTP/1.1 200 OK Content-Length: 0 access-control-max-age: 86400 access-control-allow-methods: POST, OPTIONS access-control-allow-origin: * access-control-allow-headers: content-type, content-length date: Wed, 12 Feb 2025 15:32:46 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:32:46 UTC	488	OUT	POST /report/v4?s=EDruFvqBXLiS5bcjUb4V3VeYK9fFUE2v2v0DQNTAbHHMU7WcHObkjn%2FDoWdNKJ0VrAR9z6G6dyOib8mwAUPdUcC5D%2FwnTKHaKQ3kfR634%2FAdOvPZin%2FOJi8Qwwdvr%2BvIdi%2Bv7Iw%3D HTTP/1.1 Host: a.nel.cloudflare.com Connection: keep-alive Content-Length: 410 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:32:46 UTC	410	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 31 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 39 39 31 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 31 30 34 2e 32 36 2e 33 2e 31 39 39 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 32 30 30 2c 22 74 79 70 65 22 3a 22 61 62 61 6e 64 6f 6e 65 64 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 2e 64 64 6f 73 65 63 72 65 74 73 2e 63 6f Data Ascii: [{"age":1,"body":{"elapsed_time":991,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"","sampling_fraction":1.0,"server_ip":"104.26.3.199","status_code":200,"type":"abandoned"},"type":"network-error","url":"https://data.ddosecrets.co
2025-02-12 15:32:46 UTC	168	IN	HTTP/1.1 200 OK Content-Length: 0 date: Wed, 12 Feb 2025 15:32:46 GMT Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:42 UTC	651	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https&oit=1&cp=5&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:42 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:42 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-5XC1nG_GqRWm_PANOC6pQQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:42 UTC	87	IN	Data Raw: 32 62 33 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 22 2c 5b 22 68 74 74 70 73 22 2c 22 68 74 74 70 73 20 2f 2f 6b 61 68 6f 6f 74 2e 63 6f 6d 20 6a 6f 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 71 75 69 7a 6c 65 74 2e 63 6f 6d 20 6c 69 76 65 22 2c 22 68 74 74 70 73 Data Ascii: 2b3)]}'["https",["https","https //kahoot.com join","https //quizlet.com live","https
2025-02-12 15:33:42 UTC	611	IN	Data Raw: 20 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 20 2f 69 6e 6b 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 67 69 6d 6b 69 74 2e 63 6f 6d 20 6a 6f 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 62 6c 6f 6f 6b 65 74 2e 63 6f 6d 20 6a 6f 69 6e 22 2c 22 68 74 74 70 73 3a 2f 2f 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6c 69 6e 6b 22 2c 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 65 70 69 63 67 61 6d 65 73 2e 63 6f 6d 2f 61 63 74 69 76 61 74 65 22 2c 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 2e 63 6f 6d 2f 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 Data Ascii: //www.microsoft.com /ink","https //www.gimkit.com join","https //www.blooket.com join","https://microsoft.com/link","https://www.google.com","https://www.epicgames.com/activate","https://www.youtube.com/"],["","","","","","","","","",""],[],{"google:clie
2025-02-12 15:33:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:43 UTC	654	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A&oit=4&cp=6&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:43 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:43 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-wY9ejaewmaAgK-Ea1g1CSA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:43 UTC	87	IN	Data Raw: 32 64 62 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 22 2c 5b 22 68 74 74 70 73 20 2f 2f 6b 61 68 6f 6f 74 2e 63 6f 6d 20 6a 6f 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 71 75 69 7a 6c 65 74 2e 63 6f 6d 20 6c 69 76 65 22 2c 22 68 74 74 70 73 20 2f 2f 63 68 61 74 Data Ascii: 2db)]}'["https:",["https //kahoot.com join","https //quizlet.com live","https //chat
2025-02-12 15:33:43 UTC	651	IN	Data Raw: 67 70 74 2e 63 6f 6d 20 6c 6f 67 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 20 6d 75 73 69 63 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 20 2f 69 6e 6b 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 20 6d 61 69 6c 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 67 69 6d 6b 69 74 2e 63 6f 6d 20 6a 6f 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 62 6c 6f 6f 6b 65 74 2e 63 6f 6d 20 6a 6f 69 6e 22 2c 22 68 74 74 70 73 3a 2f 2f 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6c 69 6e 6b 22 2c 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 65 70 69 63 67 61 6d 65 73 2e 63 6f 6d 2f 61 63 74 69 76 61 74 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c Data Ascii: gpt.com login","https //www.youtube music","https //www.microsoft.com /ink","https //www.yahoo.com mail","https //www.gimkit.com join","https //www.blooket.com join","https://microsoft.com/link","https://www.epicgames.com/activate"],["","","","","","","",
2025-02-12 15:33:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:45 UTC	660	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2F&oit=4&cp=8&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:45 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:45 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-oNoZY7oFtVhoX4Y0RWIeEA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:45 UTC	87	IN	Data Raw: 32 65 31 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 22 2c 5b 22 68 74 74 70 73 20 2f 2f 6b 61 68 6f 6f 74 2e 63 6f 6d 20 6a 6f 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 79 6f 75 74 75 62 65 20 6d 75 73 69 63 22 2c 22 68 74 74 70 73 20 2f 2f 71 Data Ascii: 2e1)]}'["https://",["https //kahoot.com join","https //www.youtube music","https //q
2025-02-12 15:33:45 UTC	657	IN	Data Raw: 75 69 7a 6c 65 74 2e 63 6f 6d 20 6c 69 76 65 22 2c 22 68 74 74 70 73 20 2f 2f 63 68 61 74 67 70 74 2e 63 6f 6d 20 6c 6f 67 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 20 2f 69 6e 6b 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 79 61 68 6f 6f 2e 63 6f 6d 20 6d 61 69 6c 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 67 69 6d 6b 69 74 2e 63 6f 6d 20 6a 6f 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 77 77 77 2e 62 6c 6f 6f 6b 65 74 2e 63 6f 6d 20 6a 6f 69 6e 22 2c 22 68 74 74 70 73 3a 2f 2f 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 6c 69 6e 6b 22 2c 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 65 70 69 63 67 61 6d 65 73 2e 63 6f 6d 2f 61 63 74 69 76 61 74 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 Data Ascii: uizlet.com live","https //chatgpt.com login","https //www.microsoft.com /ink","https //www.yahoo.com mail","https //www.gimkit.com join","https //www.blooket.com join","https://microsoft.com/link","https://www.epicgames.com/activate"],["","","","","","","
2025-02-12 15:33:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:46 UTC	663	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fle&oit=3&cp=10&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:46 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:46 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-4RN2VIpaJMNf_XDiub0fOQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:46 UTC	87	IN	Data Raw: 32 63 36 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 6c 65 22 2c 5b 22 68 74 74 70 73 3a 2f 2f 6c 65 6e 64 69 6e 67 2e 73 62 61 2e 67 6f 76 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 61 72 6e 69 6e 67 2e 61 6d 70 6c 69 66 79 2e 63 6f 6d 2f 68 6f 6d 65 2f 73 Data Ascii: 2c6)]}'["https://le",["https://lending.sba.gov","https://learning.amplify.com/home/s
2025-02-12 15:33:46 UTC	630	IN	Data Raw: 74 75 64 65 6e 74 2f 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 61 72 6e 2e 70 65 6e 6e 66 6f 73 74 65 72 2e 65 64 75 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 61 72 6e 2e 6a 61 2e 6f 72 67 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 6f 2e 64 6f 61 2e 6c 6f 75 69 73 69 61 6e 61 2e 67 6f 76 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 6f 6e 61 72 64 6f 2e 61 69 20 6c 6f 67 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 65 74 63 6f 64 65 2e 63 6f 6d 20 70 72 6f 62 6c 65 6d 73 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 6f 6e 61 72 64 6f 2e 61 69 20 70 72 69 63 69 6e 67 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 61 64 34 77 61 72 64 2e 63 6f 6d 20 69 71 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 76 65 6c 64 65 76 69 6c 20 32 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c Data Ascii: tudent/","https://learn.pennfoster.edu","https://learn.ja.org","https://leo.doa.louisiana.gov","https //leonardo.ai login","https //leetcode.com problems","https //leonardo.ai pricing","https //lead4ward.com iq","https //leveldevil 2"],["","","","","","",
2025-02-12 15:33:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:47 UTC	665	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Flexi&oit=3&cp=12&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:48 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:48 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-DdVYINPhbEtW2dvm-Evzzw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:48 UTC	87	IN	Data Raw: 32 39 35 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 6c 65 78 69 22 2c 5b 22 68 74 74 70 73 3a 2f 2f 6c 65 78 69 6c 65 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 78 69 63 61 2e 61 72 74 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 78 69 6e 2e 6e 61 64 Data Ascii: 295)]}'["https://lexi",["https://lexile.com","https://lexica.art","https://lexin.nad
2025-02-12 15:33:48 UTC	581	IN	Data Raw: 61 2e 6b 74 68 2e 73 65 2f 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 78 69 6e 67 74 6f 6e 74 6e 2e 67 6f 76 2f 75 74 69 6c 69 74 69 65 73 2e 68 74 6d 6c 22 2c 22 6c 65 78 69 61 20 63 6f 72 65 35 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 78 69 6c 65 2e 63 6f 6d 20 66 69 6e 64 20 61 20 62 6f 6f 6b 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 78 69 63 61 20 61 69 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 78 69 63 61 2e 61 72 74 20 61 70 69 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 78 69 63 61 2e 61 72 74 20 66 72 65 65 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 78 69 63 61 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 Data Ascii: a.kth.se/","https://lexingtontn.gov/utilities.html","lexia core5","https //lexile.com find a book","https //lexica ai","https //lexica.art api","https //lexica.art free","https //lexica"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":fals
2025-02-12 15:33:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:50 UTC	664	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Flex&oit=3&cp=11&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:50 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:50 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-yon0pkLd7WFNxxKNSxvDdw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:50 UTC	87	IN	Data Raw: 32 38 64 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 6c 65 78 22 2c 5b 22 68 74 74 70 73 3a 2f 2f 6c 65 78 69 6c 65 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 78 2e 61 61 66 65 73 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 78 69 63 61 2e Data Ascii: 28d)]}'["https://lex",["https://lexile.com","https://lex.aafes.com","https://lexica.
2025-02-12 15:33:50 UTC	573	IN	Data Raw: 61 72 74 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 78 70 72 65 73 73 2e 6d 75 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 78 69 6e 2e 6e 61 64 61 2e 6b 74 68 2e 73 65 2f 22 2c 22 6c 65 78 69 61 20 63 6f 72 65 35 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 78 69 6c 65 2e 63 6f 6d 20 66 69 6e 64 20 61 20 62 6f 6f 6b 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 78 69 63 61 20 61 69 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 78 70 72 65 73 73 2e 6d 75 20 6c 69 76 65 22 2c 22 68 74 74 70 73 20 2f 2f 6c 65 78 69 63 61 2e 61 72 74 20 61 70 69 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 Data Ascii: art","https://lexpress.mu","https://lexin.nada.kth.se/","lexia core5","https //lexile.com find a book","https //lexica ai","https //lexpress.mu live","https //lexica.art api"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":fals
2025-02-12 15:33:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:50 UTC	661	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fl&oit=3&cp=9&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:51 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:51 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-tSpDng6fICyYJ6B80ohIew' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:51 UTC	87	IN	Data Raw: 32 64 66 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 6c 22 2c 5b 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 69 2d 72 65 61 64 79 2e 63 6f 6d 2f 73 74 75 64 65 6e 74 2f 64 61 73 68 62 6f 61 72 64 2f 68 6f 6d 65 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 Data Ascii: 2df)]}'["https://l",["https://login.i-ready.com/student/dashboard/home","https://log
2025-02-12 15:33:51 UTC	655	IN	Data Raw: 69 6e 2e 6d 69 63 72 6f 73 6f 66 74 6f 6e 6c 69 6e 65 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 63 65 72 74 75 73 2e 63 6f 6d 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 65 6e 64 69 6e 67 2e 73 62 61 2e 67 6f 76 22 2c 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2e 69 2d 72 65 61 64 79 2e 63 6f 6d 22 2c 22 68 74 74 70 73 20 2f 2f 6c 6f 63 61 6c 68 6f 73 74 2e 38 30 38 30 22 2c 22 68 74 74 70 73 20 2f 2f 6c 6f 63 61 6c 68 6f 73 74 22 2c 22 68 74 74 70 73 20 2f 2f 6c 61 73 74 70 61 73 73 2e 63 6f 6d 20 6c 6f 67 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 6c 69 6e 6b 74 72 2e 65 65 20 6c 6f 67 69 6e 22 2c 22 68 74 74 70 73 20 2f 2f 6c 69 66 65 73 74 61 6e 63 65 2e 63 6f 6d 20 6c 6f 67 69 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 Data Ascii: in.microsoftonline.com","https://login.certus.com","https://lending.sba.gov","https://login.i-ready.com","https //localhost.8080","https //localhost","https //lastpass.com login","https //linktr.ee login","https //lifestance.com login"],["","","","","",""
2025-02-12 15:33:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:54 UTC	667	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddosse&oit=3&cp=14&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:54 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:54 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-GFtGOAtXu8mvLZFemMLKgw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:54 UTC	87	IN	Data Raw: 38 36 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 64 64 6f 73 73 65 22 2c 5b 5d 2c 5b 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 74 72 75 65 7d 2c 22 67 6f 6f 67 Data Ascii: 86)]}'["https://ddosse",[],[],[],{"google:clientdata":{"bpc":false,"tlw":true},"goog
2025-02-12 15:33:54 UTC	53	IN	Data Raw: 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: le:suggesttype":[],"google:verbatimrelevance":851}]
2025-02-12 15:33:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:54 UTC	668	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossec&oit=3&cp=15&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:55 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:55 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-HA1VkKZySMaa7Tgydw6S0g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:55 UTC	87	IN	Data Raw: 31 33 66 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 64 64 6f 73 73 65 63 22 2c 5b 22 68 74 74 70 73 20 73 65 63 2f 64 64 6f 73 73 65 63 20 76 75 6c 6e 65 72 61 62 69 6c 69 74 79 22 5d 2c 5b 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e Data Ascii: 13f)]}'["https://ddossec",["https sec/ddossec vulnerability"],[""],[],{"google:clien
2025-02-12 15:33:55 UTC	239	IN	Data Raw: 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 6d 70 22 3a 22 5c 75 32 30 32 36 20 22 2c 22 74 22 3a 22 73 65 63 2f 64 64 6f 73 73 65 63 20 76 75 6c 6e 65 72 61 62 69 6c 69 74 79 22 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 36 30 30 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 73 75 62 74 79 70 65 73 22 3a 5b 5b 31 30 2c 31 36 30 5d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 74 79 70 65 22 3a 5b 22 54 41 49 4c 22 5d 2c 22 67 6f 6f 67 6c 65 3a 76 65 72 62 61 74 69 6d 72 65 6c 65 76 61 6e 63 65 22 3a 38 35 31 7d 5d 0d 0a Data Ascii: tdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{"mp":"\u2026 ","t":"sec/ddossec vulnerability"}],"google:suggestrelevance":[600],"google:suggestsubtypes":[[10,160]],"google:suggesttype":["TAIL"],"google:verbatimrelevance":851}]
2025-02-12 15:33:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\Lexipol.7z.crdownload (copy)

C:\Users\user\Downloads\d1939e8f-488e-4394-b7e6-68336df483f3.tmp

Chrome Cache Entry: 100

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Windows Analysis Report
https://data.ddosecrets.com/LexipolLeaks/Lexipol.7z

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:56 UTC	672	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecrets&oit=3&cp=19&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:57 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:57 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-GTH2Qolc2Vo3kLJz0uX5tg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:57 UTC	87	IN	Data Raw: 32 61 30 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 22 2c 5b 22 64 64 6f 73 65 63 72 65 74 73 20 69 73 72 61 65 6c 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 6f 61 74 68 20 6b 65 65 70 65 72 73 22 2c 22 64 64 6f 73 65 63 Data Ascii: 2a0)]}'["https://ddossecrets",["ddosecrets israel","ddosecrets oath keepers","ddosec
2025-02-12 15:33:57 UTC	592	IN	Data Raw: 72 65 74 73 20 77 65 62 73 69 74 65 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 64 6f 77 6e 6c 6f 61 64 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 77 69 6b 69 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 74 65 6c 65 67 72 61 6d 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 6e 6f 20 66 6c 79 20 6c 69 73 74 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 61 6c 74 65 72 6e 61 74 69 76 65 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 66 6f 72 75 6d 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 73 75 62 73 74 61 63 6b 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 Data Ascii: rets website","ddosecrets download","ddosecrets wiki","ddosecrets telegram","ddosecrets no fly list","ddosecrets alternative","ddosecrets forum","ddosecrets substack"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"goog
2025-02-12 15:33:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:58 UTC	673	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecrets.&oit=3&cp=20&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:58 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:58 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-fgW_Ui9TElXCHDn6WYDwVw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:58 UTC	87	IN	Data Raw: 31 64 66 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 2e 22 2c 5b 22 68 74 74 70 73 20 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 2e 63 6f 6d 22 2c 22 68 74 74 70 73 20 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 2e 6e 65 74 22 2c Data Ascii: 1df)]}'["https://ddossecrets.",["https //ddossecrets.com","https //ddossecrets.net",
2025-02-12 15:33:58 UTC	399	IN	Data Raw: 22 68 74 74 70 73 20 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 2e 6f 72 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 74 61 69 6c 22 3a 5b 7b 22 6d 70 22 3a 22 5c 75 32 30 32 36 20 22 2c 22 74 22 3a 22 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 2e 63 6f 6d 22 7d 2c 7b 22 6d 70 22 3a 22 5c 75 32 30 32 36 20 22 2c 22 74 22 3a 22 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 2e 6e 65 74 22 7d 2c 7b 22 6d 70 22 3a 22 5c 75 32 30 32 36 20 22 2c 22 74 22 3a 22 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 2e 6f 72 67 22 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 Data Ascii: "https //ddossecrets.org"],["","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:suggestdetail":[{"mp":"\u2026 ","t":"//ddossecrets.com"},{"mp":"\u2026 ","t":"//ddossecrets.net"},{"mp":"\u2026 ","t":"//ddossecrets.org"}],"google:suggestrele
2025-02-12 15:33:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:33:59 UTC	676	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=https%3A%2F%2Fddossecrets.com&oit=3&cp=23&pgcl=2&gs_rn=42&psi=_AqROl_1Fty2vgKa&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIprbJAQipncoBCLbgygEIkqHLAQj2mM0BCIWgzQEI3L3NAQiRys0BCLnKzQEIx9HNAQiJ080BCNzTzQEIy9bNAQj01s0BCIrXzQEIp9jNAQj5wNQVGLrSzQEYy9jNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:33:59 UTC	1303	IN	HTTP/1.1 200 OK Date: Wed, 12 Feb 2025 15:33:59 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-T8vAFmer47z5aIwtzRXgfQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-02-12 15:33:59 UTC	87	IN	Data Raw: 32 61 34 0d 0a 29 5d 7d 27 0a 5b 22 68 74 74 70 73 3a 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 2e 63 6f 6d 22 2c 5b 22 64 64 6f 73 65 63 72 65 74 73 20 69 73 72 61 65 6c 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 6f 61 74 68 20 6b 65 65 70 65 72 73 22 2c 22 64 64 Data Ascii: 2a4)]}'["https://ddossecrets.com",["ddosecrets israel","ddosecrets oath keepers","dd
2025-02-12 15:33:59 UTC	596	IN	Data Raw: 6f 73 65 63 72 65 74 73 20 77 65 62 73 69 74 65 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 64 6f 77 6e 6c 6f 61 64 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 77 69 6b 69 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 74 65 6c 65 67 72 61 6d 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 6e 6f 20 66 6c 79 20 6c 69 73 74 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 61 6c 74 65 72 6e 61 74 69 76 65 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 66 6f 72 75 6d 22 2c 22 64 64 6f 73 65 63 72 65 74 73 20 73 75 62 73 74 61 63 6b 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 Data Ascii: osecrets website","ddosecrets download","ddosecrets wiki","ddosecrets telegram","ddosecrets no fly list","ddosecrets alternative","ddosecrets forum","ddosecrets substack"],["","","","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"
2025-02-12 15:33:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:34:25 UTC	678	OUT	GET /article/lexipolleaks HTTP/1.1 Host: ddossecrets.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:34:25 UTC	456	IN	HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 497 content-type: text/html; charset=utf-8 date: Wed, 12 Feb 2025 15:34:25 GMT server: Cowboy set-cookie: sid=d7225447-e956-11ef-ac7f-aa0fcda9204b; path=/; domain=.ddossecrets.com; expires=Mon, 02 Mar 2093 18:48:32 GMT; max-age=2147483647; secure; HttpOnly
2025-02-12 15:34:25 UTC	497	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 73 3a 2f 2f 64 64 6f 73 73 65 63 72 65 74 73 2e 63 6f 6d 2f 61 72 74 69 63 6c 65 2f 6c 65 78 69 70 6f 6c 6c 65 61 6b 73 3f 63 68 3d 31 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 63 7a 4f 54 4d 34 4d 54 59 32 4e 53 77 69 61 57 46 30 49 6a 6f 78 4e 7a 4d 35 4d 7a 63 Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('https://ddossecrets.com/article/lexipolleaks?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTczOTM4MTY2NSwiaWF0IjoxNzM5Mzc

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:34:25 UTC	1129	OUT	GET /article/lexipolleaks?ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTczOTM4MTY2NSwiaWF0IjoxNzM5Mzc0NDY1LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIzMGhudm4zYjN0bzE1dHNucTgwNml2NDMiLCJuYmYiOjE3MzkzNzQ0NjUsInRzIjoxNzM5Mzc0NDY1NzYxODM2fQ.CgLvQmQ6m37EDdZFDiEX0Eqo5OBc-CC3vhFmLiKj3bA&sid=d7225447-e956-11ef-ac7f-aa0fcda9204b HTTP/1.1 Host: ddossecrets.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" sec-ch-ua-platform-version: "10.0.0" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://ddossecrets.com/article/lexipolleaks Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: sid=d7225447-e956-11ef-ac7f-aa0fcda9204b
2025-02-12 15:34:26 UTC	1076	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Wed, 12 Feb 2025 15:34:26 GMT location: http://dyetui.com/f.php?e=4YjH2gyG8yctCixQJAZDJn49fjR0WnRpdXVDMGRHN1htcHJ0bSt2WmhGQ3RoNWVralZDYmR5ZFRMVEVsMlJ1bDJaa1podGVFNXBmMVlrclkzclJ6bGhERUxSWXZwR0N2UysvejB6RU1ieVFOUG1EUmQrSW1sSldPbG5XWEd2Z1NCQVkxNU9STXk2RkRuTE8rYVIxL2R6ZFlyUFF4elMyM0VkTmNadFJiUWpKWTFsUWpJZzRSeWlMamtqQWJsRXcyRFc5SURWZ2gxMTYvQllXZmVSUGpqdU44c2xzNWFPZm1ac1A3cjhKRWlvci8vbjNvUUsvdnhleTFwUkNsdDl1bWxkeTdTYWlYTm5KelFCT1REZkJ6Mnl3ckF2eFNsZEJQVUpXQnAvSEw1VkEyenFSWUl5aDE1eVQwYnVwVkk3dUJ4K09HNmhXamxmZFFlZ2JSa0J1ZHNyUFlKTjlzbG9BRmRjVEdpQ3dtRWxEbmNkc1F3TkdVT040WkFVTDBXcTFOSFB6SW1FQ0hLNGM3Y3M2TTNKTU1IUWJnYnlOeUpnVWlrSElmaGFjRzc4dTZuTWxTbFllMWJaNkR6M1BDZzJMUnhidHM1VjFCQWdwenducFVJaGJLUEtuTWdyOFRxK0lIeVVvWlNtcW55MjZvWjFyT0Q2OW1abDNoNzU5ZzlsQ3h3d2tkZTNVeTJUeWxaSjhyL2cy server: Cowboy set-cookie: sid=d7225447-e956-11ef-ac7f-aa0fcda9204b; path=/; domain=.ddossecrets.com; expires=Mon, 02 Mar 2093 18:48:33 GMT; max-age=2147483647; secure; HttpOnly
2025-02-12 15:34:26 UTC	11	IN	Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:34:30 UTC	775	OUT	GET /click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5 HTTP/1.1 Host: pephytriastared.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: http://dyetui.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-12 15:34:31 UTC	452	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 Date: Wed, 12 Feb 2025 15:34:31 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Set-Cookie: uclick=h9syzwbz1n; expires=Thu, 13-Feb-2025 15:34:31 GMT; Max-Age=86400; path=/; secure; SameSite=none Set-Cookie: uclickhash=h9syzwbz1n-h9syzwbz1n-iru3-8rxovr-52a7vr-uqwhi4-uqwhfe-e03528; expires=Thu, 13-Feb-2025 15:34:31 GMT; Max-Age=86400; path=/; secure; SameSite=none
2025-02-12 15:34:31 UTC	8637	IN	Data Raw: 31 65 61 66 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 62 61 73 65 20 68 72 65 66 3d 22 6c 61 6e 64 65 72 73 2f 76 70 6e 5f 70 72 6f 70 5f 6f 72 61 6e 67 65 5f 63 2f 65 6e 2f 30 39 66 64 37 63 64 35 33 35 32 64 63 65 37 65 61 34 34 31 36 63 62 62 34 32 31 31 31 39 65 66 30 35 39 35 35 63 37 65 2e 68 74 6d 6c 22 3e 0a 20 20 0a 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 Data Ascii: 1eaf<!DOCTYPE html><html><head><base href="landers/vpn_prop_orange_c/en/09fd7cd5352dce7ea4416cbb421119ef05955c7e.html"> <meta name="viewport" content="width=device-width, initial-scale=1.0"><meta http-equiv="Content-Type" content="text/html; charse

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:34:32 UTC	765	OUT	GET /landers/vpn_prop_orange_c/en/dl.min.js.html HTTP/1.1 Host: pephytriastared.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uclick=h9syzwbz1n; uclickhash=h9syzwbz1n-h9syzwbz1n-iru3-8rxovr-52a7vr-uqwhi4-uqwhfe-e03528
2025-02-12 15:34:32 UTC	150	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 Date: Wed, 12 Feb 2025 15:34:32 GMT Content-Type: text/html Content-Length: 555 Connection: close
2025-02-12 15:34:32 UTC	555	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:34:32 UTC	764	OUT	GET /landers/vpn_prop_orange_c/en/jquery.min.js HTTP/1.1 Host: pephytriastared.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uclick=h9syzwbz1n; uclickhash=h9syzwbz1n-h9syzwbz1n-iru3-8rxovr-52a7vr-uqwhi4-uqwhfe-e03528
2025-02-12 15:34:32 UTC	150	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 Date: Wed, 12 Feb 2025 15:34:32 GMT Content-Type: text/html Content-Length: 555 Connection: close
2025-02-12 15:34:32 UTC	555	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:34:32 UTC	816	OUT	GET /landers/vpn_prop_orange_c/en/aff_i HTTP/1.1 Host: pephytriastared.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uclick=h9syzwbz1n; uclickhash=h9syzwbz1n-h9syzwbz1n-iru3-8rxovr-52a7vr-uqwhi4-uqwhfe-e03528
2025-02-12 15:34:32 UTC	150	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 Date: Wed, 12 Feb 2025 15:34:32 GMT Content-Type: text/html Content-Length: 555 Connection: close
2025-02-12 15:34:32 UTC	555	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and

Timestamp	Bytes transferred	Direction	Data
2025-02-12 15:34:33 UTC	793	OUT	GET /favicon.ico HTTP/1.1 Host: pephytriastared.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pephytriastared.com/click.php?key=s6o47ljyu2tglzylbk75&cpv=0.024&subid=1794784791&sid=20250213023426c5ba62f47818e32be5 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: uclick=h9syzwbz1n; uclickhash=h9syzwbz1n-h9syzwbz1n-iru3-8rxovr-52a7vr-uqwhi4-uqwhfe-e03528
2025-02-12 15:34:33 UTC	150	IN	HTTP/1.1 404 Not Found Server: nginx/1.24.0 Date: Wed, 12 Feb 2025 15:34:33 GMT Content-Type: text/html Content-Length: 555 Connection: close
2025-02-12 15:34:33 UTC	555	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 34 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.24.0</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and