ip-api.com
Named by 3 kept items in this workspace.
Search every workspace for ip-api.com. It matches the name as written, so it can find other things that share it.
The items that name it 3
Queried by the bootstrapper to get the country code; exits if it is RU
Third-party service used by the final payload to collect public IP and host details.
Geolocation service fed the public IP from ipify to geolocate the victim, forming a nested lookup pattern matching prior DPRK stealer convention
All technologies in this workspace.