| upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe | 57.129.39.102 | 301 Moved Permanently | 403 B |
URL User Request GET upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe IP 57.129.39.102:443
CertificateIssuerDigiCert Inc Subjectupload.ee Fingerprint0C:4D:13:E4:9A:BF:94:BE:FE:E4:21:66:EE:7E:6B:9B:77:A5:34:59 ValiditySat, 15 Mar 2025 00:00:00 GMT - Wed, 15 Apr 2026 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /download/17876157/4a1d24015acd20625da0/svchost.exe HTTP/1.1
Host: upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Mon, 24 Mar 2025 02:30:27 GMT
Content-Type: text/html; charset=iso-8859-1
Content-Length: 279
Connection: keep-alive
Keep-Alive: timeout=5
Location: http://www.upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe
|
|
| accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AXH0vVvbW79hudARoKUIi9qIbpQSZNhJxEbChBzs9FiOY1fcJQfHWs10oYbY-j-VqIeo08JDWZ1xyg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1158739601%3A1742783429323571 | 142.250.150.84 | 403 Forbidden | 0 B |
URL GET accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AXH0vVvbW79hudARoKUIi9qIbpQSZNhJxEbChBzs9FiOY1fcJQfHWs10oYbY-j-VqIeo08JDWZ1xyg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1158739601%3A1742783429323571 IP 142.250.150.84:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint4B:95:33:75:06:A7:4B:8D:93:0F:44:A4:E7:B2:1E:51:52:D7:30:DC ValidityMon, 10 Mar 2025 08:37:54 GMT - Mon, 02 Jun 2025 08:37:53 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AXH0vVvbW79hudARoKUIi9qIbpQSZNhJxEbChBzs9FiOY1fcJQfHWs10oYbY-j-VqIeo08JDWZ1xyg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1158739601%3A1742783429323571 HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 24 Mar 2025 02:30:29 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
content-security-policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport, script-src 'nonce-BWHMLS0CoOLrkYFQgaiCng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
content-security-policy-report-only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js https://translate.google.com/translate_a/element.js https://www.google.com/recaptcha/api.js https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.google.com/tools/feedback/open_to_help_guide_lazy.js https://www.google.com/tools/feedback/help_api.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.Iew5X21fS_0.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/ https://translate.googleapis.com/_/translate_http/_/js/ https://www.gstatic.com/recaptcha/releases/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe | 57.129.39.102 | 404 Not Found | 403 B |
URL User Request GET www.upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe IP 57.129.39.102:443
CertificateIssuerDigiCert Inc Subjectupload.ee Fingerprint0C:4D:13:E4:9A:BF:94:BE:FE:E4:21:66:EE:7E:6B:9B:77:A5:34:59 ValiditySat, 15 Mar 2025 00:00:00 GMT - Wed, 15 Apr 2026 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (413), with no line terminators Hash064c56c573947308ae326c25e5dd3f7d 130e62dfb39fb2e3db66b05df82b28049160f0a3 1de380f903e59c1dfdaf78f1c50aa44e877636558cbd1d01477adff442e96f92
NIDS | Severity | Alert | suricata | medium | ET HUNTING Suspicious svchost.exe in URI - Possible Process Dump/Trojan Download |
GET /download/17876157/4a1d24015acd20625da0/svchost.exe HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 24 Mar 2025 02:30:27 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=5
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
P3P: CP="CAO PSA OUR"
Content-Encoding: gzip
|
|
| snomoneyandf.com/RkEzbUNpflAefhBzCh4aLC1GOhVzFncqdiUXZR4KHwdLDhUhNhUZKiJ8ClR0dXcKSzMvJQ5cZTU1Uhk2NXwCSyooJ1xQZTB8AkNwcm8AW21yZ0ZQcmA1Qwwke3AVHTcyLQ5cdHJzBFVwcnMLVXF+ | 172.67.160.219 | 204 No Content | 0 B |
URL GET snomoneyandf.com/RkEzbUNpflAefhBzCh4aLC1GOhVzFncqdiUXZR4KHwdLDhUhNhUZKiJ8ClR0dXcKSzMvJQ5cZTU1Uhk2NXwCSyooJ1xQZTB8AkNwcm8AW21yZ0ZQcmA1Qwwke3AVHTcyLQ5cdHJzBFVwcnMLVXF+ IP 172.67.160.219:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectsnomoneyandf.com Fingerprint76:16:D5:47:0F:D3:56:B2:95:77:D7:54:23:F6:0E:87:0D:0A:71:0E ValidityMon, 17 Feb 2025 14:43:10 GMT - Sun, 18 May 2025 15:41:47 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /RkEzbUNpflAefhBzCh4aLC1GOhVzFncqdiUXZR4KHwdLDhUhNhUZKiJ8ClR0dXcKSzMvJQ5cZTU1Uhk2NXwCSyooJ1xQZTB8AkNwcm8AW21yZ0ZQcmA1Qwwke3AVHTcyLQ5cdHJzBFVwcnMLVXF+ HTTP/1.1
Host: snomoneyandf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Mon, 24 Mar 2025 02:30:28 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8JfNBHEhJZSmtof%2F4PfSypLF2NSDkGVizNUJ7obOYB5srZeF5%2FlNtisyVlyEl7e%2FyGVABIrkF%2FC77JLhg%2BQ1fu87hJ5nsv8l%2Fh0PCzwJkdEHW%2FSNTtd%2BhiNXZtpReWWfDLKA"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 9252bf2e6bf2b529-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=4974&min_rtt=1823&rtt_var=2880&sent=9&recv=12&lost=0&retrans=0&sent_bytes=3836&recv_bytes=1700&delivery_rate=2368593&cwnd=253&unsent_bytes=0&cid=cb81e58fbd4d851c&ts=139&x=0"
X-Firefox-Spdy: h2
|
|
| accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail | 142.250.150.84 | 302 Found | 0 B |
URL GET accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail IP 142.250.150.84:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint4B:95:33:75:06:A7:4B:8D:93:0F:44:A4:E7:B2:1E:51:52:D7:30:DC ValidityMon, 10 Mar 2025 08:37:54 GMT - Mon, 02 Jun 2025 08:37:53 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&uilel=3&hl=en&service=mail HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:-nBw_R4UbJmHoZhVM7U40rsq94v-hQ:juJfgON-xhzbTgVX; Expires=Wed, 24-Mar-2027 02:30:29 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 24 Mar 2025 02:30:29 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AXH0vVt9MuzaLGFd8HqeqeAAe5orutPMPRqkJj9LOIYj-oT3ZHKnSy4ael9gsA3ksJs4WxYzysZP
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce-TGsLlCWiJwmrBv-ARfUxxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
cross-origin-resource-policy: cross-origin
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy: unsafe-none
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| ukankingwithea.com/ | 104.21.48.1 | 200 OK | 27 B |
IP 104.21.48.1:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectukankingwithea.com Fingerprint02:7E:37:44:90:B9:05:B4:82:CD:5A:71:84:A1:C8:84:66:33:BC:78 ValiditySat, 01 Mar 2025 13:28:14 GMT - Fri, 30 May 2025 14:26:54 GMT
File typeASCII text, with no line terminators Hasha10abb5562ea0b08e53ab6e1eff84288 2007283e2eda89f482b6e9da9f4abf26b0faaccf d4912b8af90b94afa0f2fdbcdd51b494e47a23552921034b85975b8e52a031e6
GET / HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 24 Mar 2025 02:30:29 GMT
content-type: text/plain
set-cookie: csu=1113215137025786@1@1742783429; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://www.upload.ee
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vE%2FgdKr%2BCI45Xl2VhtemaszJU6HpfloXyOWb%2Bv1Y3pPnRZ6DX7JA6tV4pi3zBptJeEtekGnK8oCZO5xTJ0Don1G9%2BGo6AEyNTrwx9%2FCI8GNsp9g7wuoaHPaxToTg57BKacA3Lrc%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 9252bf307db55684-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=560&min_rtt=429&rtt_var=293&sent=11&recv=14&lost=0&retrans=0&sent_bytes=4065&recv_bytes=1300&delivery_rate=8919917&cwnd=254&unsent_bytes=0&cid=ac5fc80582957ed2&ts=188&x=0"
X-Firefox-Spdy: h2
|
|
| accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AXH0vVsTx9rZiAd7fbXuyv13NWky5Vq08GiX1ybGwL9fcxLO3npLyyYyixd4c96TnNVtdhE0dUfv | 142.250.150.84 | 302 Found | 0 B |
URL GET accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AXH0vVsTx9rZiAd7fbXuyv13NWky5Vq08GiX1ybGwL9fcxLO3npLyyYyixd4c96TnNVtdhE0dUfv IP 142.250.150.84:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint4B:95:33:75:06:A7:4B:8D:93:0F:44:A4:E7:B2:1E:51:52:D7:30:DC ValidityMon, 10 Mar 2025 08:37:54 GMT - Mon, 02 Jun 2025 08:37:53 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AXH0vVsTx9rZiAd7fbXuyv13NWky5Vq08GiX1ybGwL9fcxLO3npLyyYyixd4c96TnNVtdhE0dUfv HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:eRdt8WhCF7WvxX4CULvNE8T-1zIkMA:P0b1vU4i0rFgcF8J;Path=/;Expires=Wed, 24-Mar-2027 02:30:29 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 24 Mar 2025 02:30:29 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&hl=en&ifkv=AXH0vVvbW79hudARoKUIi9qIbpQSZNhJxEbChBzs9FiOY1fcJQfHWs10oYbY-j-VqIeo08JDWZ1xyg&passive=true&service=youtube&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S1158739601%3A1742783429323571
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: require-trusted-types-for 'script';report-uri /cspreport, script-src 'nonce-KNkTkQ9UgWnenfruZ68cCQ' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 420
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error | 57.129.39.102 | 200 OK | 19 kB |
URL User Request GET www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error IP 57.129.39.102:443
CertificateIssuerDigiCert Inc Subjectupload.ee Fingerprint0C:4D:13:E4:9A:BF:94:BE:FE:E4:21:66:EE:7E:6B:9B:77:A5:34:59 ValiditySat, 15 Mar 2025 00:00:00 GMT - Wed, 15 Apr 2026 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (4526) Hashaea3939bfc16f6eff781de7ed715a08d 7f865450fa17d8eca08401305a08ce2eea91484d 6b0343ea0ce4fa723020d320e23def200370c644f8be5c41063c73ed0fdcaba4
GET /files/17876157/svchost.exe.html?msg=sess_error HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 24 Mar 2025 02:30:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
P3P: CP="CAO PSA OUR"
Content-Encoding: gzip
Set-Cookie: lng=eng; expires=Mon, 21-Apr-2025 02:30:28 GMT; path=/; domain=www.upload.ee; secure; httponly; SameSite=None
Last-Modified: Mon, 24 Mar 2025 02:30:28 GMT
|
|
| www.upload.ee/js/js__file_upload.js | 57.129.39.102 | 200 OK | 26 kB |
URL GET www.upload.ee/js/js__file_upload.js IP 57.129.39.102:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerDigiCert Inc Subjectupload.ee Fingerprint0C:4D:13:E4:9A:BF:94:BE:FE:E4:21:66:EE:7E:6B:9B:77:A5:34:59 ValiditySat, 15 Mar 2025 00:00:00 GMT - Wed, 15 Apr 2026 23:59:59 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /js/js__file_upload.js HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 24 Mar 2025 02:30:28 GMT
Content-Type: application/javascript
Last-Modified: Wed, 03 Jul 2024 13:31:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
ETag: W/"66855297-651c"
Expires: Mon, 31 Mar 2025 02:30:28 GMT
Cache-Control: max-age=604800
Vary: Accept-Encoding
Content-Encoding: gzip
|
|
| www.upload.ee/images/arrow.gif | 57.129.39.102 | 200 OK | 59 B |
URL GET www.upload.ee/images/arrow.gif IP 57.129.39.102:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerDigiCert Inc Subjectupload.ee Fingerprint0C:4D:13:E4:9A:BF:94:BE:FE:E4:21:66:EE:7E:6B:9B:77:A5:34:59 ValiditySat, 15 Mar 2025 00:00:00 GMT - Wed, 15 Apr 2026 23:59:59 GMT
File typeGIF image data, version 89a, 6 x 9 Hash6675f814b94f13f91f1383707b250e36 31452650e8fce2095613a2010799bdb7548bdd51 061d01a0b85f948c6ec464870ecec4654c4bd2ff15cacda941bbbf16225ec411
GET /images/arrow.gif HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 24 Mar 2025 02:30:28 GMT
Content-Type: image/gif
Content-Length: 59
Last-Modified: Wed, 03 Jul 2024 13:31:03 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "66855297-3b"
Expires: Mon, 31 Mar 2025 02:30:28 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
|
|
| du0pud0sdlmzf.cloudfront.net/?dupud=997369 | 3.164.247.63 | 200 OK | 385 kB |
URL GET du0pud0sdlmzf.cloudfront.net/?dupud=997369 IP 3.164.247.63:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerAmazon Subject*.cloudfront.net Fingerprint28:D3:87:79:3C:E8:8B:3C:D9:10:45:E5:F7:64:7A:6D:44:4E:5A:62 ValidityTue, 30 Jul 2024 00:00:00 GMT - Thu, 03 Jul 2025 23:59:59 GMT
Size385 kB (384931 bytes) Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /?dupud=997369 HTTP/1.1
Host: du0pud0sdlmzf.cloudfront.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-length: 127337
date: Mon, 24 Mar 2025 02:30:28 GMT
access-control-allow-origin: *
cache-control: no-store, no-cache, proxy-revalidate, must-revalidate, private, no-transform
content-encoding: gzip
pragma: no-cache
x-cache: Miss from cloudfront
via: 1.1 e3aded687d9d5fd28450d38e25aba824.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN53-P2
x-amz-cf-id: pvSvldGcI9kfnx9faHLjjD7XkgSRyeM9EhwJNZE8ja7ddvsXuUeYwQ==
X-Firefox-Spdy: h2
|
|
| www.googletagmanager.com/gtag/js?id=G-LT9YQX0N49&l=dataLayer&cx=c>m=457e53k0h2za200&tag_exp=102482433~102788824~102803279~102813109~102887799 | 142.250.74.168 | 200 OK | 340 kB |
URL GET www.googletagmanager.com/gtag/js?id=G-LT9YQX0N49&l=dataLayer&cx=c>m=457e53k0h2za200&tag_exp=102482433~102788824~102803279~102813109~102887799 IP 142.250.74.168:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subject*.google-analytics.com Fingerprint16:BA:A3:B5:22:51:BB:87:46:7F:17:3F:9D:14:B3:35:F0:FE:B1:8D ValidityMon, 10 Mar 2025 08:35:59 GMT - Mon, 02 Jun 2025 08:35:58 GMT
File typeJavaScript source, ASCII text, with very long lines (5343) Size340 kB (340287 bytes) Hash217f83d30aaa33ac40abe3b7e01f0d13 651d7a59160921d2f2d0dd7fe3504273da3100db f63400d167d15a38078252292bd9b1da990efc8a79fa57981160ec040db4b8ee
GET /gtag/js?id=G-LT9YQX0N49&l=dataLayer&cx=c>m=457e53k0h2za200&tag_exp=102482433~102788824~102803279~102813109~102887799 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/3 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 24 Mar 2025 02:30:28 GMT
expires: Mon, 24 Mar 2025 02:30:28 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1020:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1020:0
report-to: {"group":"ascgcycc:1020:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1020:0"}],}
server: Google Tag Manager
content-length: 116159
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
|
|
| hertouchingthew.com/Y2xTOVMCDjBUbAJRMR8mEQBuHGElSWF/NxZcI0w3Ux83VT4ZCn1aPwwZN18hDAInFz0GGHYLFS41OG8VOTQ4exgKHxdrOzofGm87Ijtgc2E2XBF8HTcPEnFiWxUeURk7KilsIyAENH4yGi0SYSQEXhheICk0Kl4gKzgJazcyBx9yFjIUA04VJjk+dCMhLjB/NiQhEn8kJVg3fB46LjpdZzY6a24dMAMcaxI2Bh54azopKnRiJRQRfB4gPgp/ElNJYX8fIgcFeGEhXxoJKy4IBHsLMDk8QB8iHzd9BypeAnwnMCcpfxIwXRkJNzYYGWtgOiQCfCcwIToUJC84YmM0BwU3WgYrOWpsY1IkN143Ij9icGAuXBFyGlA+YWwFBz8xfhE7PwJsNCkLZ24BUA8Xb2MPODdhBTY/BXc0B10GXxAZDzR4KzoNCnEwCT8VfysCXQVfFVAEYx85EAM9SW4OBSt2YFMgPWg | 143.204.55.111 | 200 OK | 3.1 kB |
URL GET hertouchingthew.com/Y2xTOVMCDjBUbAJRMR8mEQBuHGElSWF/NxZcI0w3Ux83VT4ZCn1aPwwZN18hDAInFz0GGHYLFS41OG8VOTQ4exgKHxdrOzofGm87Ijtgc2E2XBF8HTcPEnFiWxUeURk7KilsIyAENH4yGi0SYSQEXhheICk0Kl4gKzgJazcyBx9yFjIUA04VJjk+dCMhLjB/NiQhEn8kJVg3fB46LjpdZzY6a24dMAMcaxI2Bh54azopKnRiJRQRfB4gPgp/ElNJYX8fIgcFeGEhXxoJKy4IBHsLMDk8QB8iHzd9BypeAnwnMCcpfxIwXRkJNzYYGWtgOiQCfCcwIToUJC84YmM0BwU3WgYrOWpsY1IkN143Ij9icGAuXBFyGlA+YWwFBz8xfhE7PwJsNCkLZ24BUA8Xb2MPODdhBTY/BXc0B10GXxAZDzR4KzoNCnEwCT8VfysCXQVfFVAEYx85EAM9SW4OBSt2YFMgPWg IP 143.204.55.111:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerAmazon Subjecthertouchingthew.com FingerprintC2:CC:41:7E:9C:49:A6:0E:71:95:4F:E2:B5:D8:6D:F9:84:10:36:CF ValiditySun, 09 Mar 2025 00:00:00 GMT - Tue, 07 Apr 2026 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (3085), with no line terminators Hash8fe2c49b5304b698bc3c3d3b22e48ea7 bf882f854fc4d9922b0774dd82a6eaaddfd1105a 9b22da7e305328befa058d918541190ce7ec2cd227e45269b79f4348a7c0832c
GET /Y2xTOVMCDjBUbAJRMR8mEQBuHGElSWF/NxZcI0w3Ux83VT4ZCn1aPwwZN18hDAInFz0GGHYLFS41OG8VOTQ4exgKHxdrOzofGm87Ijtgc2E2XBF8HTcPEnFiWxUeURk7KilsIyAENH4yGi0SYSQEXhheICk0Kl4gKzgJazcyBx9yFjIUA04VJjk+dCMhLjB/NiQhEn8kJVg3fB46LjpdZzY6a24dMAMcaxI2Bh54azopKnRiJRQRfB4gPgp/ElNJYX8fIgcFeGEhXxoJKy4IBHsLMDk8QB8iHzd9BypeAnwnMCcpfxIwXRkJNzYYGWtgOiQCfCcwIToUJC84YmM0BwU3WgYrOWpsY1IkN143Ij9icGAuXBFyGlA+YWwFBz8xfhE7PwJsNCkLZ24BUA8Xb2MPODdhBTY/BXc0B10GXxAZDzR4KzoNCnEwCT8VfysCXQVfFVAEYx85EAM9SW4OBSt2YFMgPWg HTTP/1.1
Host: hertouchingthew.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1206
date: Mon, 24 Mar 2025 02:30:29 GMT
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
set-cookie: AWSALB=aQpBhyXJDteJUNIy0HafRoqe2Z1glvTKXQtEMwC+jVlbyEhYnKp+MwjeDk9k/2b312N9HjaS0zjLhlo40J6IAVdNqMCtZJmbzx8InIPKSDxMyntMMWRws2OGCLVJ; Expires=Mon, 31 Mar 2025 02:30:29 GMT; Path=/
AWSALBCORS=aQpBhyXJDteJUNIy0HafRoqe2Z1glvTKXQtEMwC+jVlbyEhYnKp+MwjeDk9k/2b312N9HjaS0zjLhlo40J6IAVdNqMCtZJmbzx8InIPKSDxMyntMMWRws2OGCLVJ; Expires=Mon, 31 Mar 2025 02:30:29 GMT; Path=/; SameSite=None
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: EMP6mfViXGMMglJTBdO-TXo5kID65aj1iMmKIFeDNdFVbnfytpspug==
X-Firefox-Spdy: h2
|
|
| www.upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe | 57.129.39.102 | 302 Found | 403 B |
URL User Request GET www.upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe IP 57.129.39.102:80
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
NIDS | Severity | Alert | suricata | medium | ET HUNTING Suspicious svchost.exe in URI - Possible Process Dump/Trojan Download |
GET /download/17876157/4a1d24015acd20625da0/svchost.exe HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Mon, 24 Mar 2025 02:30:27 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=5
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
Location: https://www.upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe
|
|
| www.upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe | 57.129.39.102 | 404 Not Found | 403 B |
URL User Request GET www.upload.ee/download/17876157/4a1d24015acd20625da0/svchost.exe IP 57.129.39.102:443
CertificateIssuerDigiCert Inc Subjectupload.ee Fingerprint0C:4D:13:E4:9A:BF:94:BE:FE:E4:21:66:EE:7E:6B:9B:77:A5:34:59 ValiditySat, 15 Mar 2025 00:00:00 GMT - Wed, 15 Apr 2026 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (413), with no line terminators Hash064c56c573947308ae326c25e5dd3f7d 130e62dfb39fb2e3db66b05df82b28049160f0a3 1de380f903e59c1dfdaf78f1c50aa44e877636558cbd1d01477adff442e96f92
NIDS | Severity | Alert | suricata | medium | ET HUNTING Suspicious svchost.exe in URI - Possible Process Dump/Trojan Download |
GET /download/17876157/4a1d24015acd20625da0/svchost.exe HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Mon, 24 Mar 2025 02:30:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=5
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1
P3P: CP="CAO PSA OUR"
Content-Encoding: gzip
|
|
| undefined/a0JQcHMKIDMdTAp/MlYGGS5tVUEtZ2I2Fx5yIAUXWzE0HB4RJH4THwQ3NBYBBCwkXh0ONnVCNVkgYRgrOXAzPT0RKTgnMRg6HUMDDhQ9SRkPc2k6OCgXOTElIjQZNDEhBTkXRCADCTwXAQs5ISI+MB8zGDMXOjkeIQE4FhIcehY5Gxg4CiFCKQUpOQkOLjQ6PS8bIDE1IWdiMj4CKRUlHgc6Ghc+JRgHPhsuJWUcPAIlNDIZOnUaGzkPCj06Az1yIAEpWXoBMhkyOBsyMggkByZAKBAkSSkzJgcoQDEsCRwiHyQHJkAuAwlCKjMMEygxGzs0JhAzID1dPQIUE0FKMRozJjQzczsyHzEhMjgfWBY7AAIxOxEzNy8PZCkfPjIxHRdZFGFJAzFxCjMrPCUoPBs+CQAaFE5wFiEfWycKHiE/EwcYCyYuIBVVATE/HgNWKCETPFtxCDI2HyliOg | 0.0.0.0 | | 0 B |
URL GET undefined/a0JQcHMKIDMdTAp/MlYGGS5tVUEtZ2I2Fx5yIAUXWzE0HB4RJH4THwQ3NBYBBCwkXh0ONnVCNVkgYRgrOXAzPT0RKTgnMRg6HUMDDhQ9SRkPc2k6OCgXOTElIjQZNDEhBTkXRCADCTwXAQs5ISI+MB8zGDMXOjkeIQE4FhIcehY5Gxg4CiFCKQUpOQkOLjQ6PS8bIDE1IWdiMj4CKRUlHgc6Ghc+JRgHPhsuJWUcPAIlNDIZOnUaGzkPCj06Az1yIAEpWXoBMhkyOBsyMggkByZAKBAkSSkzJgcoQDEsCRwiHyQHJkAuAwlCKjMMEygxGzs0JhAzID1dPQIUE0FKMRozJjQzczsyHzEhMjgfWBY7AAIxOxEzNy8PZCkfPjIxHRdZFGFJAzFxCjMrPCUoPBs+CQAaFE5wFiEfWycKHiE/EwcYCyYuIBVVATE/HgNWKCETPFtxCDI2HyliOg IP 0.0.0.0:0
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer | Verdict | Alert | Quad9 DNS | malicious | Sinkholed |
GET /a0JQcHMKIDMdTAp/MlYGGS5tVUEtZ2I2Fx5yIAUXWzE0HB4RJH4THwQ3NBYBBCwkXh0ONnVCNVkgYRgrOXAzPT0RKTgnMRg6HUMDDhQ9SRkPc2k6OCgXOTElIjQZNDEhBTkXRCADCTwXAQs5ISI+MB8zGDMXOjkeIQE4FhIcehY5Gxg4CiFCKQUpOQkOLjQ6PS8bIDE1IWdiMj4CKRUlHgc6Ghc+JRgHPhsuJWUcPAIlNDIZOnUaGzkPCj06Az1yIAEpWXoBMhkyOBsyMggkByZAKBAkSSkzJgcoQDEsCRwiHyQHJkAuAwlCKjMMEygxGzs0JhAzID1dPQIUE0FKMRozJjQzczsyHzEhMjgfWBY7AAIxOxEzNy8PZCkfPjIxHRdZFGFJAzFxCjMrPCUoPBs+CQAaFE5wFiEfWycKHiE/EwcYCyYuIBVVATE/HgNWKCETPFtxCDI2HyliOg HTTP/1.1
Host: undefined
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| snomoneyandf.com/b3lPN0NARixEfiA8HWEXOywNUwQ1Tw1AL1YgBw8FLDEZXCUIGmlDKgtEdg50W0h7ETMGHXIGZRwNLkM2HER+ESoBHyAKZRlEfhlwW1d8AW1bXzoKckkNP1YkUkhpRzcbFXIGdFtLeA9wW0t3D3Rd | 172.67.160.219 | 204 No Content | 0 B |
URL GET snomoneyandf.com/b3lPN0NARixEfiA8HWEXOywNUwQ1Tw1AL1YgBw8FLDEZXCUIGmlDKgtEdg50W0h7ETMGHXIGZRwNLkM2HER+ESoBHyAKZRlEfhlwW1d8AW1bXzoKckkNP1YkUkhpRzcbFXIGdFtLeA9wW0t3D3Rd IP 172.67.160.219:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectsnomoneyandf.com Fingerprint76:16:D5:47:0F:D3:56:B2:95:77:D7:54:23:F6:0E:87:0D:0A:71:0E ValidityMon, 17 Feb 2025 14:43:10 GMT - Sun, 18 May 2025 15:41:47 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /b3lPN0NARixEfiA8HWEXOywNUwQ1Tw1AL1YgBw8FLDEZXCUIGmlDKgtEdg50W0h7ETMGHXIGZRwNLkM2HER+ESoBHyAKZRlEfhlwW1d8AW1bXzoKckkNP1YkUkhpRzcbFXIGdFtLeA9wW0t3D3Rd HTTP/1.1
Host: snomoneyandf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Mon, 24 Mar 2025 02:30:28 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fSWe%2BAzf8VMXYrWGCfk%2Bi7UxLPf9%2FJ7xUNO9ILwL4fZ5322F%2F%2BJRyf0YQ7frf8lkCnaLWhBx4oXm0%2FyB1Ihd9%2B%2FRuiwkrPq0IlLnFeUvafnch2lfGpMrjIahUVNO7ufq4ORk"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 9252bf2e7c01b529-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=4768&min_rtt=1823&rtt_var=2573&sent=10&recv=13&lost=0&retrans=0&sent_bytes=4261&recv_bytes=1700&delivery_rate=2368593&cwnd=255&unsent_bytes=0&cid=cb81e58fbd4d851c&ts=155&x=0"
X-Firefox-Spdy: h2
|
|
| www.upload.ee/favicon.ico | 57.129.39.102 | 200 OK | 1.2 kB |
URL GET www.upload.ee/favicon.ico IP 57.129.39.102:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerDigiCert Inc Subjectupload.ee Fingerprint0C:4D:13:E4:9A:BF:94:BE:FE:E4:21:66:EE:7E:6B:9B:77:A5:34:59 ValiditySat, 15 Mar 2025 00:00:00 GMT - Wed, 15 Apr 2026 23:59:59 GMT
File typeMS Windows icon resource - 1 icon, 16x16, 32 bits/pixel Hashf299cf2e651c19e48d27900ced493ccb c2d1086d517d7a26292e0d7b32da7c55b166c23b 115c8eb4840245f7aed0cb2a17fa7e91b86f79bb2f223a25af8cc533e1dedff1
GET /favicon.ico HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error
Cookie: lng=eng; _ga_LT9YQX0N49=GS1.1.1742783428.1.0.1742783429.0.0.0; _ga=GA1.1.1956585781.1742783429
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 24 Mar 2025 02:30:29 GMT
Content-Type: image/x-icon
Content-Length: 1150
Last-Modified: Wed, 03 Jul 2024 13:31:03 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "66855297-47e"
Expires: Mon, 31 Mar 2025 02:30:29 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
|
|
| ukankingwithea.com/asd100.bin | 104.21.48.1 | 200 OK | 102 kB |
URL GET ukankingwithea.com/asd100.bin IP 104.21.48.1:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectukankingwithea.com Fingerprint02:7E:37:44:90:B9:05:B4:82:CD:5A:71:84:A1:C8:84:66:33:BC:78 ValiditySat, 01 Mar 2025 13:28:14 GMT - Fri, 30 May 2025 14:26:54 GMT
Size102 kB (102400 bytes) Hash4c6426ac7ef186464ecbb0d81cbfcb1e 5a6918eebd9d635e8f632e3ef34e3792b1b5ec13 f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16
GET /asd100.bin HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 24 Mar 2025 02:30:29 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://www.upload.ee
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: EXPIRED
last-modified: Mon, 24 Mar 2025 02:30:29 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3ase%2FeMZvxMRieAm3kzkcWuQ%2B0L5RhgqrWBtS3Xw8Sn0ir7YkqGKLEEsjLpj%2FepZ%2FXeHJdDM6rZbHl9CCVFAULe816CQgooxWdE8fOeCIdyJwCTbN19XEz%2Bp%2F2Wb7gwo49LLGpI%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9252bf306d9f5684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=697&min_rtt=429&rtt_var=387&sent=13&recv=16&lost=0&retrans=0&sent_bytes=4639&recv_bytes=1300&delivery_rate=8919917&cwnd=256&unsent_bytes=0&cid=ac5fc80582957ed2&ts=290&x=0"
X-Firefox-Spdy: h2
|
|
| accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AXH0vVt9MuzaLGFd8HqeqeAAe5orutPMPRqkJj9LOIYj-oT3ZHKnSy4ael9gsA3ksJs4WxYzysZP | 142.250.150.84 | 302 Found | 0 B |
URL GET accounts.google.com/InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AXH0vVt9MuzaLGFd8HqeqeAAe5orutPMPRqkJj9LOIYj-oT3ZHKnSy4ael9gsA3ksJs4WxYzysZP IP 142.250.150.84:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint4B:95:33:75:06:A7:4B:8D:93:0F:44:A4:E7:B2:1E:51:52:D7:30:DC ValidityMon, 10 Mar 2025 08:37:54 GMT - Mon, 02 Jun 2025 08:37:53 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /InteractiveLogin?continue=https://www.google.com/favicon.ico&hl=en&passive=true&service=mail&uilel=3&ifkv=AXH0vVt9MuzaLGFd8HqeqeAAe5orutPMPRqkJj9LOIYj-oT3ZHKnSy4ael9gsA3ksJs4WxYzysZP HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
set-cookie: __Host-GAPS=1:fvjro5sf8uQ0s1dYsJ_UzYsw9r5-jw:SiCLEwBdL5va7iyb;Path=/;Expires=Wed, 24-Mar-2027 02:30:29 GMT;Secure;HttpOnly;Priority=HIGH
x-frame-options: DENY
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 24 Mar 2025 02:30:29 GMT
location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AXH0vVtym2VZfXttA8d95u27ZHGBBK8mcrOYg_rolKr6hTZ-tiZCkn0Y0_j86jRDCNHdf7XDTLJ3Tg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1439269516%3A1742783429329052
strict-transport-security: max-age=31536000; includeSubDomains
content-security-policy: script-src 'nonce--RJH8kHK4IuqzP0ptKxJXg' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport, require-trusted-types-for 'script';report-uri /cspreport
report-to: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
cross-origin-opener-policy-report-only: same-origin; report-to="coop_gse_qebhlk"
content-encoding: gzip
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
content-length: 417
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AXH0vVtym2VZfXttA8d95u27ZHGBBK8mcrOYg_rolKr6hTZ-tiZCkn0Y0_j86jRDCNHdf7XDTLJ3Tg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1439269516%3A1742783429329052 | 142.250.150.84 | 403 Forbidden | 0 B |
URL GET accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AXH0vVtym2VZfXttA8d95u27ZHGBBK8mcrOYg_rolKr6hTZ-tiZCkn0Y0_j86jRDCNHdf7XDTLJ3Tg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1439269516%3A1742783429329052 IP 142.250.150.84:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint4B:95:33:75:06:A7:4B:8D:93:0F:44:A4:E7:B2:1E:51:52:D7:30:DC ValidityMon, 10 Mar 2025 08:37:54 GMT - Mon, 02 Jun 2025 08:37:53 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /v3/signin/identifier?continue=https%3A%2F%2Fwww.google.com%2Ffavicon.ico&hl=en&ifkv=AXH0vVtym2VZfXttA8d95u27ZHGBBK8mcrOYg_rolKr6hTZ-tiZCkn0Y0_j86jRDCNHdf7XDTLJ3Tg&passive=true&service=mail&uilel=3&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1439269516%3A1742783429329052 HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 403 Forbidden
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 24 Mar 2025 02:30:29 GMT
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-opener-policy-report-only: same-origin; report-to="AccountsSignInUi"
content-security-policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport, script-src 'nonce-yKoKX0FbPHsgIFoirPubSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/allowlist
content-security-policy-report-only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://ajax.googleapis.com/ajax/libs/jquery/3.6.4/jquery.min.js https://translate.google.com/translate_a/element.js https://www.google.com/recaptcha/api.js https://www.google.com/tools/feedback/load.js https://www.google.com/tools/feedback/open.js https://www.google.com/tools/feedback/open_to_help_guide_lazy.js https://www.google.com/tools/feedback/help_api.js https://www.gstatic.com/inproduct_help/service/lazy.min.js https://www.gstatic.com/inproduct_help/api/main.min.js https://www.gstatic.com/inproduct_help/chatsupport/chatsupport_button_v2.js https://www.gstatic.com/feedback/js/help/prod/service/lazy.min.js https://www.gstatic.com/uservoice/feedback/client/web/live/ https://www.google.com/tools/feedback/chat_load.js https://www.gstatic.com/uservoice/surveys/resources/prod/js/survey/ https://www.gstatic.com/feedback/js/ghelp/ https://www.gstatic.com/_/mss/boq-one-google/_/ https://www.gstatic.com/og/_/js/ https://apis.google.com/js/api.js https://apis.google.com/js/client.js https://www.googletagmanager.com/gtag/js https://www.google-analytics.com/analytics.js https://www.googletagmanager.com/gtag/destination https://www.gstatic.com/_/mss/boq-identity/_/js/k=boq-identity.AccountsSignInUi.en.Iew5X21fS_0.es5.O/ https://apis.google.com/_/scs/abc-static/_/js/ https://translate.googleapis.com/_/translate_http/_/js/ https://www.gstatic.com/recaptcha/releases/;report-uri /v3/signin/_/AccountsSignInUi/cspreport/fine-allowlist
report-to: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube | 142.250.150.84 | 302 Found | 0 B |
URL GET accounts.google.com/ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube IP 142.250.150.84:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectaccounts.google.com Fingerprint4B:95:33:75:06:A7:4B:8D:93:0F:44:A4:E7:B2:1E:51:52:D7:30:DC ValidityMon, 10 Mar 2025 08:37:54 GMT - Mon, 02 Jun 2025 08:37:53 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /ServiceLogin?passive=true&continue=https%3A%2F%2Fwww.youtube.com%2Ffavicon.ico&uilel=3&hl=en&service=youtube HTTP/1.1
Host: accounts.google.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
content-type: application/binary
set-cookie: __Host-GAPS=1:JoQBfC09mCXk3z6VYBfR51aW6Ctu0w:h20BUuFafb39dBm1; Expires=Wed, 24-Mar-2027 02:30:29 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Mon, 24 Mar 2025 02:30:29 GMT
location: https://accounts.google.com/InteractiveLogin?continue=https://www.youtube.com/favicon.ico&hl=en&passive=true&service=youtube&uilel=3&ifkv=AXH0vVsTx9rZiAd7fbXuyv13NWky5Vq08GiX1ybGwL9fcxLO3npLyyYyixd4c96TnNVtdhE0dUfv
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-opener-policy: unsafe-none
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'nonce-zozs5q0b6pLoOH64My9CyA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self', script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/AccountsSigninPassiveLoginHttp/cspreport/allowlist, require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
server: ESF
content-length: 0
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| ukankingwithea.com/asd100.bin | 104.21.48.1 | 200 OK | 102 kB |
URL GET ukankingwithea.com/asd100.bin IP 104.21.48.1:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectukankingwithea.com Fingerprint02:7E:37:44:90:B9:05:B4:82:CD:5A:71:84:A1:C8:84:66:33:BC:78 ValiditySat, 01 Mar 2025 13:28:14 GMT - Fri, 30 May 2025 14:26:54 GMT
Size102 kB (102400 bytes) Hash4c6426ac7ef186464ecbb0d81cbfcb1e 5a6918eebd9d635e8f632e3ef34e3792b1b5ec13 f627ca4c2c322f15db26152df306bd4f983f0146409b81a4341b9b340c365a16
GET /asd100.bin HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 24 Mar 2025 02:30:29 GMT
content-type: binary/octet-stream
access-control-allow-origin: https://www.upload.ee
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cache-control: max-age=14400
cf-cache-status: EXPIRED
last-modified: Mon, 24 Mar 2025 02:30:29 GMT
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BvdyQno9aC68bPinXKtzY4LtsQ2JoBWG%2ByNYd1cBk%2B5dmq4Cvxz41MWiaHjV7KfwPU03xl5RjFT99o27s43hnmyt8PmrCtFRPSGGEpAiHWBG5WCDvBMfxADCa%2FqtDYpOwcQfYE0%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 9252bf309dc95684-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=701&min_rtt=429&rtt_var=108&sent=49&recv=22&lost=0&retrans=0&sent_bytes=53026&recv_bytes=1300&delivery_rate=43063197&cwnd=256&unsent_bytes=0&cid=ac5fc80582957ed2&ts=422&x=0"
X-Firefox-Spdy: h2
|
|
| www.upload.ee/static/ubr__style.css | 57.129.39.102 | 200 OK | 9.4 kB |
URL GET www.upload.ee/static/ubr__style.css IP 57.129.39.102:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerDigiCert Inc Subjectupload.ee Fingerprint0C:4D:13:E4:9A:BF:94:BE:FE:E4:21:66:EE:7E:6B:9B:77:A5:34:59 ValiditySat, 15 Mar 2025 00:00:00 GMT - Wed, 15 Apr 2026 23:59:59 GMT
File typeASCII text, with very long lines (9680), with no line terminators Hashab59a1bc9fadd0961e5f60c35aa9052a 5785a15139773ccec5942d241743d0f26d0e36c4 b5bb8632acdad4c1ee9ef902886c1a1475178561c5c17dc4d1b54c849bd60a8a
GET /static/ubr__style.css HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 24 Mar 2025 02:30:28 GMT
Content-Type: text/css
Last-Modified: Wed, 03 Jul 2024 13:31:03 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Keep-Alive: timeout=20
ETag: W/"66855297-24da"
Expires: Mon, 31 Mar 2025 02:30:28 GMT
Cache-Control: max-age=604800
Vary: Accept-Encoding
Content-Encoding: gzip
|
|
| www.upload.ee/images/dl_.png | 57.129.39.102 | 200 OK | 1.9 kB |
URL GET www.upload.ee/images/dl_.png IP 57.129.39.102:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerDigiCert Inc Subjectupload.ee Fingerprint0C:4D:13:E4:9A:BF:94:BE:FE:E4:21:66:EE:7E:6B:9B:77:A5:34:59 ValiditySat, 15 Mar 2025 00:00:00 GMT - Wed, 15 Apr 2026 23:59:59 GMT
File typePNG image data, 154 x 32, 8-bit colormap, non-interlaced Hashf3e8f284a4e98cdb91b6abfc142d94a4 fa9e618c2f56bea752ddd7e45a372c5539dadda9 2f13919383f54ca21e5b87f5644df8a875b99815c821dcbbabea352d854c6882
GET /images/dl_.png HTTP/1.1
Host: www.upload.ee
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error
Cookie: lng=eng
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 24 Mar 2025 02:30:28 GMT
Content-Type: image/png
Content-Length: 1900
Last-Modified: Wed, 03 Jul 2024 13:31:03 GMT
Connection: keep-alive
Keep-Alive: timeout=20
ETag: "66855297-76c"
Expires: Mon, 31 Mar 2025 02:30:28 GMT
Cache-Control: max-age=604800
Accept-Ranges: bytes
|
|
| www.googletagmanager.com/gtag/js?id=UA-6703115-1 | 142.250.74.168 | 200 OK | 243 kB |
URL GET www.googletagmanager.com/gtag/js?id=UA-6703115-1 IP 142.250.74.168:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subject*.google-analytics.com Fingerprint16:BA:A3:B5:22:51:BB:87:46:7F:17:3F:9D:14:B3:35:F0:FE:B1:8D ValidityMon, 10 Mar 2025 08:35:59 GMT - Mon, 02 Jun 2025 08:35:58 GMT
File typeJavaScript source, ASCII text, with very long lines (2432) Size243 kB (242619 bytes) Hash00695561bc773259d35d5e9cc4ea23ae 4c3e8fe2b582a75c8f33c09e1ab6421172a2488b 4d11fb2dece1fadb4a2ecc79f1d41d2b8752e2200e2eb465f34f190813fa321d
GET /gtag/js?id=UA-6703115-1 HTTP/1.1
Host: www.googletagmanager.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Mon, 24 Mar 2025 02:30:28 GMT
expires: Mon, 24 Mar 2025 02:30:28 GMT
cache-control: private, max-age=900
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1020:0
cross-origin-opener-policy-report-only: same-origin; report-to=ascgcycc:1020:0
report-to: {"group":"ascgcycc:1020:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1020:0"}],}
server: Google Tag Manager
content-length: 86814
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
|
|
| snomoneyandf.com/NEhtMW8bdw5CUmYcPwIgc31dc18AAjppLnIaGgA3UC8jdSxyK0tFBlB1VAhYAHhVFx9dLFAAVxI7GVAbQTtQAEldJgteUhI+UABBBGZfH1oSPVAASUA4DFZSBW4dRRtYdVwGWwZ/VQJbBnBVBFk | 172.67.160.219 | 204 No Content | 0 B |
URL GET snomoneyandf.com/NEhtMW8bdw5CUmYcPwIgc31dc18AAjppLnIaGgA3UC8jdSxyK0tFBlB1VAhYAHhVFx9dLFAAVxI7GVAbQTtQAEldJgteUhI+UABBBGZfH1oSPVAASUA4DFZSBW4dRRtYdVwGWwZ/VQJbBnBVBFk IP 172.67.160.219:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectsnomoneyandf.com Fingerprint76:16:D5:47:0F:D3:56:B2:95:77:D7:54:23:F6:0E:87:0D:0A:71:0E ValidityMon, 17 Feb 2025 14:43:10 GMT - Sun, 18 May 2025 15:41:47 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /NEhtMW8bdw5CUmYcPwIgc31dc18AAjppLnIaGgA3UC8jdSxyK0tFBlB1VAhYAHhVFx9dLFAAVxI7GVAbQTtQAEldJgteUhI+UABBBGZfH1oSPVAASUA4DFZSBW4dRRtYdVwGWwZ/VQJbBnBVBFk HTTP/1.1
Host: snomoneyandf.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 204 No Content
date: Mon, 24 Mar 2025 02:30:28 GMT
access-control-allow-origin: *
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OaOheGoy0H0aAqm3RYcelB16uxKRPxfTwGc1Xa%2BZSWnogAc780qoEBPqMnugu8C1YTmDr7%2BFmAW6M61YVY84ZiZWK8ZP6j74ii%2BQnOZyjRCUGvdzydwD%2B12EJ%2B5vmUiHy60g"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 9252bf2e6bf3b529-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=4974&min_rtt=1823&rtt_var=2880&sent=8&recv=12&lost=0&retrans=0&sent_bytes=3264&recv_bytes=1700&delivery_rate=2368593&cwnd=253&unsent_bytes=0&cid=cb81e58fbd4d851c&ts=139&x=0"
X-Firefox-Spdy: h2
|
|
| hertouchingthew.com/VlFuMlk3Mw1fZjdsDBQsJD1TF2sQdFx0PSNhHkc9ZiIKXjQsN0BRNTkkClQrOT8aHDczJUsAHxoHKGQqGDoZARYxGz9RIBdpLXMtZzM5eAAUYgZLEwRkOnk0PTgpAh8/GD1nGAECXkU8IT06UzNiPC8DPm4wPWc4FzsCXxEEBytXMzUGJAAhJxgtChAVYhZLFgdgN3lrOistZD4gMDlgEgAoCQA4EDY/fRoHZyxFKiQcB3MeACteSxMEZAhTMBNhO2QqPB0ERRgBOF9KAy8+Kms0BCY2VQM9GBRFGgM4I1gTPTorVB05OT1jC24LOWQaFDwCXB9mfAV3PxUcVnM+FGUNZQAjFF0HMhoHAXE4ATI2YQgEaSRbFxwTPwM1DD0Jaz8eYBlqPg8jI2YAHgY5XjQTYFp1PwEDAmoIDGgNZT01BC1nNBsQHmgXHhcAeT4ydFx0AB4lDXcdOiE0c388IgFcKWshGAYsZBkXQG81EiVo | 143.204.55.111 | 200 OK | 3.1 kB |
URL GET hertouchingthew.com/VlFuMlk3Mw1fZjdsDBQsJD1TF2sQdFx0PSNhHkc9ZiIKXjQsN0BRNTkkClQrOT8aHDczJUsAHxoHKGQqGDoZARYxGz9RIBdpLXMtZzM5eAAUYgZLEwRkOnk0PTgpAh8/GD1nGAECXkU8IT06UzNiPC8DPm4wPWc4FzsCXxEEBytXMzUGJAAhJxgtChAVYhZLFgdgN3lrOistZD4gMDlgEgAoCQA4EDY/fRoHZyxFKiQcB3MeACteSxMEZAhTMBNhO2QqPB0ERRgBOF9KAy8+Kms0BCY2VQM9GBRFGgM4I1gTPTorVB05OT1jC24LOWQaFDwCXB9mfAV3PxUcVnM+FGUNZQAjFF0HMhoHAXE4ATI2YQgEaSRbFxwTPwM1DD0Jaz8eYBlqPg8jI2YAHgY5XjQTYFp1PwEDAmoIDGgNZT01BC1nNBsQHmgXHhcAeT4ydFx0AB4lDXcdOiE0c388IgFcKWshGAYsZBkXQG81EiVo IP 143.204.55.111:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerAmazon Subjecthertouchingthew.com FingerprintC2:CC:41:7E:9C:49:A6:0E:71:95:4F:E2:B5:D8:6D:F9:84:10:36:CF ValiditySun, 09 Mar 2025 00:00:00 GMT - Tue, 07 Apr 2026 23:59:59 GMT
File typeHTML document, ASCII text, with very long lines (3095), with no line terminators Hashb2314cd640c473f2955aaa8d9934caef ea563526bd321a13f2f4e112dee60968d799cabf d03fb14889c5498452242fc266c154db1bee74303dd3ad4a7924acbe9e48e230
GET /VlFuMlk3Mw1fZjdsDBQsJD1TF2sQdFx0PSNhHkc9ZiIKXjQsN0BRNTkkClQrOT8aHDczJUsAHxoHKGQqGDoZARYxGz9RIBdpLXMtZzM5eAAUYgZLEwRkOnk0PTgpAh8/GD1nGAECXkU8IT06UzNiPC8DPm4wPWc4FzsCXxEEBytXMzUGJAAhJxgtChAVYhZLFgdgN3lrOistZD4gMDlgEgAoCQA4EDY/fRoHZyxFKiQcB3MeACteSxMEZAhTMBNhO2QqPB0ERRgBOF9KAy8+Kms0BCY2VQM9GBRFGgM4I1gTPTorVB05OT1jC24LOWQaFDwCXB9mfAV3PxUcVnM+FGUNZQAjFF0HMhoHAXE4ATI2YQgEaSRbFxwTPwM1DD0Jaz8eYBlqPg8jI2YAHgY5XjQTYFp1PwEDAmoIDGgNZT01BC1nNBsQHmgXHhcAeT4ydFx0AB4lDXcdOiE0c388IgFcKWshGAYsZBkXQG81EiVo HTTP/1.1
Host: hertouchingthew.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://www.upload.ee/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/html
content-length: 1214
date: Mon, 24 Mar 2025 02:30:28 GMT
accept-ch: DPR, Width, Viewport-Width, Device-Memory, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List
set-cookie: AWSALB=ZOFY67d8xrM0EHxS0BlMu806RNzENrUinf3+c4r5pOJslI68VCvuPX1DSv2sZ0QHpYrCG60IVXsq3TvExmaRiumt9nMP0soitWwZF1d7Ta9YWwyG6bDS2D9pVLYJ; Expires=Mon, 31 Mar 2025 02:30:28 GMT; Path=/
AWSALBCORS=ZOFY67d8xrM0EHxS0BlMu806RNzENrUinf3+c4r5pOJslI68VCvuPX1DSv2sZ0QHpYrCG60IVXsq3TvExmaRiumt9nMP0soitWwZF1d7Ta9YWwyG6bDS2D9pVLYJ; Expires=Mon, 31 Mar 2025 02:30:28 GMT; Path=/; SameSite=None
server: openresty/1.17.8.2
cache-control: no-store, no-cache, must-revalidate, no-transform
pragma: no-cache
p3p: CP="NID DSP ALL COR"
content-encoding: gzip
x-cache: Miss from cloudfront
via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: HsccjKz9p0JCUFawuyr2aWBQ9dga7I8cv1I-WqVZtDThHEjTMx59JQ==
X-Firefox-Spdy: h2
|
|
| ukankingwithea.com/ | 104.21.48.1 | 200 OK | 26 B |
IP 104.21.48.1:443
Requested byhttps://www.upload.ee/files/17876157/svchost.exe.html?msg=sess_error CertificateIssuerGoogle Trust Services Subjectukankingwithea.com Fingerprint02:7E:37:44:90:B9:05:B4:82:CD:5A:71:84:A1:C8:84:66:33:BC:78 ValiditySat, 01 Mar 2025 13:28:14 GMT - Fri, 30 May 2025 14:26:54 GMT
File typeASCII text, with no line terminators Hash84925fa3425664de4d9e60e53ee7f082 1715a881b93ac44320524f0b7fddd22d8b07e26a 4c529038816649ff05a5ccfab35b0e5b8fa43235549b5e6f6fe992001109be53
GET / HTTP/1.1
Host: ukankingwithea.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://www.upload.ee/
Origin: https://www.upload.ee
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Mon, 24 Mar 2025 02:30:29 GMT
content-type: text/plain
set-cookie: csu=762755111769356@1@1742783429; Max-Age=31104000; Secure; SameSite=None
access-control-allow-origin: https://www.upload.ee
access-control-allow-credentials: true
access-control-allow-methods: GET
access-control-allow-headers: X-Requested-With, content-type
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A0ZjDRhmSvxwYYhKSfUjdbW8OO0oaRUkuHbzI2%2FNyNgJkfu0qPHEYGJhdQ%2F%2Btz9WW7xC2EjDnee2IE86bhEeoD9vkyYMptUV0ub7cMpQmqqAjWDvvznBN2mnaTNSgELmzbZcpWY%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 9252bf307dac5684-OSL
content-encoding: br
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=560&min_rtt=429&rtt_var=293&sent=9&recv=14&lost=0&retrans=0&sent_bytes=3218&recv_bytes=1300&delivery_rate=8919917&cwnd=254&unsent_bytes=0&cid=ac5fc80582957ed2&ts=187&x=0"
X-Firefox-Spdy: h2
|
|