Loading ...

Play interactive tourEdit tour

Analysis Report lfQuSBwdSf.exe

Overview

General Information

Sample Name:lfQuSBwdSf.exe
Analysis ID:383847
MD5:0802967c1d72deeb4e1b79af74fdb553
SHA1:f8edbbed8318311f070167c73fcca9f63f79c905
SHA256:201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb
Tags:exeSnakeKeylogger
Infos:

Most interesting Screenshot:

Detection

Snake Keylogger
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected Snake Keylogger
Adds a directory exclusion to Windows Defender
Changes security center settings (notifications, updates, antivirus, firewall)
Creates an autostart registry key pointing to binary in C:\Windows
Drops PE files with benign system names
Drops executables to the windows directory (C:\Windows) and starts them
Hides threads from debuggers
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
May check the online IP address of the machine
Tries to delay execution (extensive OutputDebugStringW loop)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Yara detected Beds Obfuscator
Antivirus or Machine Learning detection for unpacked file
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
One or more processes crash
PE file contains an invalid checksum
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection

Classification

Startup

  • System is w10x64
  • lfQuSBwdSf.exe (PID: 2788 cmdline: 'C:\Users\user\Desktop\lfQuSBwdSf.exe' MD5: 0802967C1D72DEEB4E1B79AF74FDB553)
    • powershell.exe (PID: 1004 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 4808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 720 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\lfQuSBwdSf.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 4456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 1000 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 3984 cmdline: 'C:\Windows\System32\cmd.exe' /c timeout 1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • timeout.exe (PID: 6248 cmdline: timeout 1 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)
    • lfQuSBwdSf.exe (PID: 6864 cmdline: C:\Users\user\Desktop\lfQuSBwdSf.exe MD5: 0802967C1D72DEEB4E1B79AF74FDB553)
    • WerFault.exe (PID: 6164 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 2300 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • svchost.exe (PID: 4908 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6216 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6528 cmdline: 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' MD5: 0802967C1D72DEEB4E1B79AF74FDB553)
  • svchost.exe (PID: 6624 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6672 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6712 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6872 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 6908 cmdline: 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' MD5: 0802967C1D72DEEB4E1B79AF74FDB553)
    • powershell.exe (PID: 4424 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 2120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 5092 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 5136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • powershell.exe (PID: 3348 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)
      • conhost.exe (PID: 5224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • svchost.exe (PID: 6932 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 7064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 7152 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 1648 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • svchost.exe (PID: 5232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)
  • cleanup

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "SMTP Info": {"Port": "587", "SMTP Credential": "bal@nobettwo.xyzKvgnCIGBE8+Hnobettwo.xyz"}}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmpJoeSecurity_BedsObfuscatorYara detected Beds ObfuscatorJoe Security
    00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmpJoeSecurity_SnakeKeyloggerYara detected Snake KeyloggerJoe Security
      00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmpJoeSecurity_BedsObfuscatorYara detected Beds ObfuscatorJoe Security
        00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmpJoeSecurity_SnakeKeyloggerYara detected Snake KeyloggerJoe Security
          00000011.00000002.517681508.0000000004965000.00000004.00000001.sdmpJoeSecurity_BedsObfuscatorYara detected Beds ObfuscatorJoe Security
            Click to see the 1 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            23.2.svchost.exe.4a72390.5.unpackJoeSecurity_BedsObfuscatorYara detected Beds ObfuscatorJoe Security
              23.2.svchost.exe.4a72390.5.unpackJoeSecurity_SnakeKeyloggerYara detected Snake KeyloggerJoe Security
                23.2.svchost.exe.4ad53b0.6.unpackJoeSecurity_BedsObfuscatorYara detected Beds ObfuscatorJoe Security
                  23.2.svchost.exe.4ad53b0.6.unpackJoeSecurity_SnakeKeyloggerYara detected Snake KeyloggerJoe Security
                    23.2.svchost.exe.4ad53b0.6.raw.unpackJoeSecurity_BedsObfuscatorYara detected Beds ObfuscatorJoe Security
                      Click to see the 13 entries

                      Sigma Overview

                      No Sigma rule has matched

                      Signature Overview

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection:

                      barindex
                      Found malware configurationShow sources
                      Source: 00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmpMalware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "SMTP Info": {"Port": "587", "SMTP Credential": "bal@nobettwo.xyzKvgnCIGBE8+Hnobettwo.xyz"}}
                      Multi AV Scanner detection for dropped fileShow sources
                      Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exeReversingLabs: Detection: 29%
                      Multi AV Scanner detection for submitted fileShow sources
                      Source: lfQuSBwdSf.exeVirustotal: Detection: 24%Perma Link
                      Source: lfQuSBwdSf.exeReversingLabs: Detection: 29%
                      Machine Learning detection for dropped fileShow sources
                      Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exeJoe Sandbox ML: detected
                      Machine Learning detection for sampleShow sources
                      Source: lfQuSBwdSf.exeJoe Sandbox ML: detected
                      Source: 21.2.lfQuSBwdSf.exe.400000.0.unpackAvira: Label: TR/Spy.Gen
                      Source: unknownHTTPS traffic detected: 104.21.56.119:443 -> 192.168.2.3:49701 version: TLS 1.0
                      Source: unknownHTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49725 version: TLS 1.0
                      Source: unknownHTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49737 version: TLS 1.0
                      Source: unknownHTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49777 version: TLS 1.0
                      Source: lfQuSBwdSf.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                      Source: Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbOS source: lfQuSBwdSf.exe, 00000000.00000002.341939107.00000000013F2000.00000004.00000020.sdmp
                      Source: Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbs source: lfQuSBwdSf.exe, 00000000.00000002.341939107.00000000013F2000.00000004.00000020.sdmp
                      Source: Binary string: npAjVisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
                      Source: Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbs source: lfQuSBwdSf.exe, 00000000.00000002.341262404.00000000013C2000.00000004.00000020.sdmp
                      Source: Binary string: \??\C:\Windows\dll\mscorlib.pdb source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmp
                      Source: Binary string: (P6jLC:\Windows\Microsoft.VisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
                      Source: Binary string: lfQuSBwdSf.PDB source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
                      Source: Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb, source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
                      Source: Binary string: \??\C:\Windows\mscorlib.pdb source: lfQuSBwdSf.exe, 00000000.00000002.341262404.00000000013C2000.00000004.00000020.sdmp
                      Source: Binary string: \??\C:\Users\user\Desktop\lfQuSBwdSf.PDB source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
                      Source: Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb1G source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
                      Source: Binary string: C:\Users\user\Desktop\lfQuSBwdSf.PDB source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
                      Source: Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.341262404.00000000013C2000.00000004.00000020.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdby source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
                      Source: Binary string: .pdb%H source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
                      Source: Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp

                      Networking:

                      barindex
                      May check the online IP address of the machineShow sources
                      Source: C:\Users\user\Desktop\lfQuSBwdSf.exeDNS query: name: checkip.dyndns.org
                      Source: C:\Users\user\Desktop\lfQuSBwdSf.exeDNS query: name: checkip.dyndns.org
                      Source: C:\Users\user\Desktop\lfQuSBwdSf.exeDNS query: name: checkip.dyndns.org
                      Source: C:\Users\user\Desktop\lfQuSBwdSf.exeDNS query: name: checkip.dyndns.org
                      Source: unknownDNS query: name: checkip.dyndns.org
                      Source: unknownDNS query: name: checkip.dyndns.org
                      Source: unknownDNS query: name: checkip.dyndns.org
                      Source: unknownDNS query: name: checkip.dyndns.org
                      Source: C:\Users\user\Desktop\lfQuSBwdSf.exeDNS query: name: checkip.dyndns.org
                      Source: C:\Users\user\Desktop\lfQuSBwdSf.exeDNS query: name: checkip.dyndns.org
                      Source: unknownDNS query: name: checkip.dyndns.org
                      Source: unknownDNS query: name: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7C92219C6C42B363C26A6A670922F074.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cfConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-133B76AB9374D6781F41A2D553BC2BA3.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cf
                      Source: global trafficHTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-5C52937048F55BFE92995966F69D90F1.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cf
                      Source: Joe Sandbox ViewIP Address: 162.88.193.70 162.88.193.70
                      Source: Joe Sandbox ViewJA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: unknownHTTPS traffic detected: 104.21.56.119:443 -> 192.168.2.3:49701 version: TLS 1.0
                      Source: unknownHTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49725 version: TLS 1.0
                      Source: unknownHTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49737 version: TLS 1.0
                      Source: unknownHTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49777 version: TLS 1.0
                      Source: global trafficHTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7C92219C6C42B363C26A6A670922F074.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cfConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-133B76AB9374D6781F41A2D553BC2BA3.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cf
                      Source: global trafficHTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-5C52937048F55BFE92995966F69D90F1.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cf
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: global trafficHTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher" itemscope="itemscope" itemtype="https://schema.org/NewsMediaOrganization"><meta itemprop="publishingPrinciples" content="https://www.liverpool.com/about-us/"><meta itemprop="name" content="Liverpool.com"><meta itemprop="url" content="https://www.liverpool.com/"><div itemprop="logo" itemscope="itemscope" itemtype="https://schema.org/ImageObject"><meta itemprop="url" content="https://s2-prod.liverpool.com/@trinitymirrordigital/chameleon-branding/publications/liverpool/img/logo-liverpool.png"></div></div><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&amp;Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/rules/">Competition Rules</a></li><li><a href="https://www.liverpool.com/how-to-complain/">How to Complain</a></li><li><a href="https://www.liverpool.com/corrections-clarifications/">Corrections &amp; Clarifications</a></li><li><a href="https://www.liverpool.com/privacy-notice/">Privacy Notice</a></li><li><a href="https://www.liverpool.com"> equals www.facebook.com (Facebook)
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher" itemscope="itemscope" itemtype="https://schema.org/NewsMediaOrganization"><meta itemprop="publishingPrinciples" content="https://www.liverpool.com/about-us/"><meta itemprop="name" content="Liverpool.com"><meta itemprop="url" content="https://www.liverpool.com/"><div itemprop="logo" itemscope="itemscope" itemtype="https://schema.org/ImageObject"><meta itemprop="url" content="https://s2-prod.liverpool.com/@trinitymirrordigital/chameleon-branding/publications/liverpool/img/logo-liverpool.png"></div></div><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&amp;Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/rules/">Competition Rules</a></li><li><a href="https://www.liverpool.com/how-to-complain/">How to Complain</a></li><li><a href="https://www.liverpool.com/corrections-clarifications/">Corrections &amp; Clarifications</a></li><li><a href="https://www.liverpool.com/privacy-notice/">Privacy Notice</a></li><li><a href="https://www.liverpool.com"> equals www.twitter.com (Twitter)
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: <header class="mod-header" data-mod="header" data-immediate><div class="primary publication-theme-highlight"><a data-link-tracking="Header|MainLogo|Image|liverpool" id="logo" href="/">liverpool</a><a class="icon" id="hamburger" href="#">Load mobile navigation<span></span></a><nav class="primary"><section><ul data-level="1"><li class="has-children"><a data-link-tracking="Header|SectionLabel|Text|Liverpool FC News" href="https://www.liverpool.com/liverpool-fc-news/">Liverpool FC News</a><ul data-level="2"><li><a data-link-tracking="Header|DropDown|Text|Latest News" href="https://www.liverpool.com/liverpool-fc-news/">Latest News</a></li><li><a data-link-tracking="Header|DropDown|Text|Transfer News" href="https://www.liverpool.com/liverpool-fc-news/transfer-news/">Transfer News</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li class="has-children"><a data-link-tracking="Header|SectionLabel|Text|Schedule" href="https://www.liverpool.com/schedule/">Schedule</a><ul data-level="2"><li><a data-link-tracking="Header|DropDown|Text|Premier League" href="https://www.liverpool.com/all-about/premier-league">Premier League</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li><a data-link-tracking="Header|SectionLabel|Text|Features" href="https://www.liverpool.com/liverpool-fc-news/features/">Features</a></li></ul></section></nav><profile-icon lr-custom-id="signin" lr-custom-class="header-profile-icon" lr-gtm-label="header" lr-show-account-link></profile-icon><div class="search"><button class="icon icon-search" id="search-icon" type="button" aria-label="Search"></button></div><div class="search-box hidden"><gcse:searchbox-only resultsUrl="https://www.liverpool.com/search/"></gcse:searchbox-only></div><div class="social-sites"><ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|top"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|top"></a></li></ul></div></div><nav class="secondary" data-smooth-scroll><section><ul class="click-track" data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/advertising/">Advertise with us</a></li></ul></section></nav><nav class="footer"><section><ul data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&amp;Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/r
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: <header class="mod-header" data-mod="header" data-immediate><div class="primary publication-theme-highlight"><a data-link-tracking="Header|MainLogo|Image|liverpool" id="logo" href="/">liverpool</a><a class="icon" id="hamburger" href="#">Load mobile navigation<span></span></a><nav class="primary"><section><ul data-level="1"><li class="has-children"><a data-link-tracking="Header|SectionLabel|Text|Liverpool FC News" href="https://www.liverpool.com/liverpool-fc-news/">Liverpool FC News</a><ul data-level="2"><li><a data-link-tracking="Header|DropDown|Text|Latest News" href="https://www.liverpool.com/liverpool-fc-news/">Latest News</a></li><li><a data-link-tracking="Header|DropDown|Text|Transfer News" href="https://www.liverpool.com/liverpool-fc-news/transfer-news/">Transfer News</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li class="has-children"><a data-link-tracking="Header|SectionLabel|Text|Schedule" href="https://www.liverpool.com/schedule/">Schedule</a><ul data-level="2"><li><a data-link-tracking="Header|DropDown|Text|Premier League" href="https://www.liverpool.com/all-about/premier-league">Premier League</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li><a data-link-tracking="Header|SectionLabel|Text|Features" href="https://www.liverpool.com/liverpool-fc-news/features/">Features</a></li></ul></section></nav><profile-icon lr-custom-id="signin" lr-custom-class="header-profile-icon" lr-gtm-label="header" lr-show-account-link></profile-icon><div class="search"><button class="icon icon-search" id="search-icon" type="button" aria-label="Search"></button></div><div class="search-box hidden"><gcse:searchbox-only resultsUrl="https://www.liverpool.com/search/"></gcse:searchbox-only></div><div class="social-sites"><ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook|follow|top"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter|follow|top"></a></li></ul></div></div><nav class="secondary" data-smooth-scroll><section><ul class="click-track" data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/advertising/">Advertise with us</a></li></ul></section></nav><nav class="footer"><section><ul data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&amp;Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/r
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: <meta property="og:site_name" content="Liverpool.com"><meta property="og:language" content="en"><meta property="og:type" content="article"><meta property="og:title" content="The Brewster Experience has underdelivered so far, but that will change"><meta property="og:url" content="https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763"><meta property="og:description" content="Rhian Brewster was hyped up before the start of the season, but was that fair?"><meta property="og:image" content="https://i2-prod.liverpoolecho.co.uk/incoming/article17172788.ece/ALTERNATES/s1200/1_GettyImages-1178657262.jpg"><meta property="og:section" content="Features"><meta property="article:tag" content="Rhian Brewster"><meta property="article:author" content="https://www.facebook.com/kristianwalsh1987/"><meta property="article:published_time" content="2019-10-30T16:00:00Z"><meta property="article:modified_time" content="2019-10-30T15:36:53Z"><meta property="article:expiration_time" content="2019-11-29T15:36:53Z"><meta property="article:section" content="Features"><meta property="article:id" content="liverpool-17172763"> equals www.facebook.com (Facebook)
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: n, Gomez/Lovren, James Milner, Oxlade-Chamberlain, Naby Keita and Divock Origi. An impressive outing against Arsenal could nudge him ahead of Adam Lallana, or even Harvey Elliott, in the fight for that seventh spot.</p> <p>The world is still expected to be at Brewster&apos;s feet at Liverpool. It is just a matter of waiting for him to be passed it.</p><!-- Article End--></div><div id="social-follow" data-mod="socialFollow"><div id="social-methods"><div class="facebook-share"><span class="icon facebook large"></span><div class="fb-like" data-href="https://www.facebook.com/liverpooldotcom" data-layout="button_count" data-action="like" data-size="large" data-width="300" data-show-faces="false" data-share="false"></div><span class="page-name">liverpooldotcom</span></div><div class="twitter-share" data-follow-url="https://twitter.com/intent/follow?screen_name=liverpoolcom_"><span class="icon twitter large"></span><a>Follow @<span>liverpoolcom_</span></a></div></div></div><div class="tag-list"><span class="publication-theme-border publication-theme-icon">More On</span><ul><li><a class="publication-theme-button-highlight" href="https://www.liverpool.com/all-about/rhian-brewster" data-link-tracking="EndArticle|Tag">Rhian Brewster</a></li></ul></div></div><aside class="related-column secondary"></aside></div></article> equals www.facebook.com (Facebook)
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: n, Gomez/Lovren, James Milner, Oxlade-Chamberlain, Naby Keita and Divock Origi. An impressive outing against Arsenal could nudge him ahead of Adam Lallana, or even Harvey Elliott, in the fight for that seventh spot.</p> <p>The world is still expected to be at Brewster&apos;s feet at Liverpool. It is just a matter of waiting for him to be passed it.</p><!-- Article End--></div><div id="social-follow" data-mod="socialFollow"><div id="social-methods"><div class="facebook-share"><span class="icon facebook large"></span><div class="fb-like" data-href="https://www.facebook.com/liverpooldotcom" data-layout="button_count" data-action="like" data-size="large" data-width="300" data-show-faces="false" data-share="false"></div><span class="page-name">liverpooldotcom</span></div><div class="twitter-share" data-follow-url="https://twitter.com/intent/follow?screen_name=liverpoolcom_"><span class="icon twitter large"></span><a>Follow @<span>liverpoolcom_</span></a></div></div></div><div class="tag-list"><span class="publication-theme-border publication-theme-icon">More On</span><ul><li><a class="publication-theme-button-highlight" href="https://www.liverpool.com/all-about/rhian-brewster" data-link-tracking="EndArticle|Tag">Rhian Brewster</a></li></ul></div></div><aside class="related-column secondary"></aside></div></article> equals www.twitter.com (Twitter)
                      Source: unknownDNS traffic detected: queries for: myliverpoolnews.cf
                      Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmpString found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
                      Source: powershell.exe, 00000005.00000002.514285099.0000000002F19000.00000004.00000020.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                      Source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmpString found in binary or memory: http://crl3.d
                      Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmpString found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
                      Source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmpString found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
                      Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmpString found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
                      Source: lfQuSBwdSf.exe, 00000000.00000002.344997356.00000000030C1000.00000004.00000001.sdmpString found in binary or memory: http://myliverpoolnews.cf
                      Source: lfQuSBwdSf.exe, 00000000.00000002.344997356.00000000030C1000.00000004.00000001.sdmpString found in binary or memory: http://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-
                      Source: powershell.exe, 00000005.00000002.536067747.00000000058E2000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.535279406.0000000005E25000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                      Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmpString found in binary or memory: http://ocsp.digicert.com0
                      Source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmpString found in binary or memory: http://ocsp.digicert.com0:
                      Source: powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: http://schema.org/BreadcrumbList
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: http://schema.org/ListItem
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: http://schema.org/NewsArticle
                      Source: powershell.exe, 00000005.00000002.526440831.00000000049BB000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
                      Source: lfQuSBwdSf.exe, 00000000.00000002.344997356.00000000030C1000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.522995118.0000000004881000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.520364713.0000000004DC1000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                      Source: powershell.exe, 00000005.00000002.526440831.00000000049BB000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
                      Source: powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                      Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmpString found in binary or memory: http://www.digicert.com/CPS0v
                      Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmpString found in binary or memory: https://%s.dnet.xboxlive.com
                      Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmpString found in binary or memory: https://%s.xboxlive.com
                      Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmpString found in binary or memory: https://activity.windows.com
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://ads.pubmatic.com/AdServer/js/pwt/156997/3236/pwt.js
                      Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmpString found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://c.amazon-adsystem.com/aax2/apstag.js
                      Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmpString found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
                      Source: powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/
                      Source: powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/Icon
                      Source: powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmpString found in binary or memory: https://contoso.com/License
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://felix.data.tm-awx.com
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://felix.data.tm-awx.com/ampconfig.json&quot;
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://felix.data.tm-awx.com/felix.min.js
                      Source: powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmpString found in binary or memory: https://github.com/Pester/Pester
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://github.com/ded/script.js
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article17156435.ece/ALTERNATES/s615/1_GettyImages-1183794835.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article17166876.ece/ALTERNATES/s615/0_GettyImages-1175998874.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-02-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s270b/0_WhatsApp-Image-2021-02
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s220b/0_Salah-Pressing.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s270b/0_Salah-Pressing.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s615/0_Salah-Pressing.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s180/0_Curtis-10.png
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s220b/0_Curtis-10.png
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s270b/0_Curtis-10.png
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s615/0_Curtis-10.png
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s180/0_Salah-Goal-vs-Leeds.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s220b/0_Salah-Goal-vs-Leeds.jp
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s270b/0_Salah-Goal-vs-Leeds.jp
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s615/0_Salah-Goal-vs-Leeds.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s220b/0_RobertsonCross1.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s270b/0_RobertsonCross1.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s180/0_GettyImages-1231353837.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s220b/0_GettyImages-1231353837
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s270b/0_GettyImages-1231353837
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s180/0_GettyImages-1304940818.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s458/0_GettyImages-1304940818.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s615/0_GettyImages-1304940818.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s180/1_FreeAgentPlayers.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s458/1_FreeAgentPlayers.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s615/1_FreeAgentPlayers.jpg
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s180/0_GettyImages-1273716690.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s458/0_GettyImages-1273716690.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s615/0_GettyImages-1273716690.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s180/0_GettyImages-1302496803.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s458/0_GettyImages-1302496803.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s615/0_GettyImages-1302496803.
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s458/1_WhatsApp-Image-2021-03-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s615/1_WhatsApp-Image-2021-03-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpoolecho.co.uk/incoming/article17165318.ece/ALTERNATES/s615/2_GettyImages-11837
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://i2-prod.liverpoolecho.co.uk/incoming/article17172788.ece/ALTERNATES/s1200/1_GettyImages-1178
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://mab.data.tm-awx.com/rhs&quot;
                      Source: lfQuSBwdSf.exe, 00000000.00000002.345654171.00000000030F0000.00000004.00000001.sdmpString found in binary or memory: https://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal
                      Source: lfQuSBwdSf.exe, 00000000.00000002.345654171.00000000030F0000.00000004.00000001.sdmpString found in binary or memory: https://myliverpoolnews.cf4&l
                      Source: powershell.exe, 00000005.00000002.536067747.00000000058E2000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.535279406.0000000005E25000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://quantcast.mgr.consensu.org
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://reach-id.orbit.tm-awx.com/analytics.js.gz
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://reachplc.hub.loginradius.com&quot;
                      Source: lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmpString found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://s2-prod.liverpool.com
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://s2-prod.liverpool.com/
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://s2-prod.mirror.co.uk/
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://securepubads.g.doubleclick.net/tag/js/gpt.js
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://static.hotjar.com/c/hotjar-
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://trinitymirror.grapeshot.co.uk/
                      Source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://www.google-analytics.com
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://www.googletagmanager.com
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-M3TH25P
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/andrew-robertson
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/champions-league
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/curtis-jones
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/georginio-wijnaldum
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/mohamed-salah
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/ozan-kabak
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/premier-league
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/sadio-mane
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/steven-gerrard
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/all-about/transfers
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/
                      Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/
                      Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166
                      Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-andy-robertson-valuable-quality-19946
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-arsenal-klopp-lijnders-carabao-171668
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-barcelona-real-madrid-psg-17164868
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-champions-league-jurgen-klopp-1996194
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-curtis-jones-jurgen-klopp-19941053
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-gini-wijnaldum-rumours-fitness-199533
                      Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-jurgen-klopp-pressing-tactics-1993836
                      Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-ozan-kabak-future-audition-19954616
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-penalties-premier-league-var-17171391
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-psg-transfer-news-19957850
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-sadio-mane-expected-goals-19932676
                      Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/mohamed-salah-liverpool-goal-flaw-19945816
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763&
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish-199590
                      Source: lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/featuresnC
                      Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmpString found in binary or memory: https://www.liverpool.com/liverpool-fc-news/transfer-news/
                      Source: