Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

URLScan

urlscan

10

https://u.to/gWWCHw

windows10-2004-x64

1

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/04/2023, 19:32 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://u.to/gWWCHw

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://u.to/gWWCHw
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4264 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1636

Network

  • flag-us
    DNS
    u.to
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    u.to
    IN A
    Response
    u.to
    IN A
    195.216.243.155
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-ru
    GET
    https://u.to/gWWCHw
    IEXPLORE.EXE
    Remote address:
    195.216.243.155:443
    Request
    GET /gWWCHw HTTP/1.1
    Accept: text/html, application/xhtml+xml, image/jxr, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: u.to
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Found
    Server: nginx/1.8.0
    Date: Wed, 19 Apr 2023 19:27:50 GMT
    Content-Type: text/html; charset=iso-8859-1
    Transfer-Encoding: chunked
    Connection: keep-alive
    Keep-Alive: timeout=15
    Set-Cookie: lng=en; path=/; expires=Thu, 18-Apr-2024 19:27:50 GMT; domain=.u.to;
    Location: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
  • flag-us
    DNS
    naughtylady.life
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    naughtylady.life
    IN A
    Response
    naughtylady.life
    IN A
    185.155.184.83
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/css/bootstrap.css
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/css/bootstrap.css HTTP/1.1
    Accept: text/css, */*
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: text/css
    Content-Length: 110239
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "47ec8e4c717bce27e3dec25375b64c16"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBA472138B
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#615580025/gid:0/gname:root/mode:33279/mtime:1655385539#758681000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:18:59.758681Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/js/main.js
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/js/main.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: application/javascript
    Content-Length: 1446
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "e2a64608889abbe3782f28e512a421dd"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBB1E13469
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#623580037/gid:0/gname:root/mode:33279/mtime:1655385542#354685000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:19:02.354685Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1 HTTP/1.1
    Accept: text/html, application/xhtml+xml, image/jxr, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Connection: Keep-Alive
    Host: naughtylady.life
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:24 GMT
    Content-Type: text/html
    Content-Length: 12986
    Connection: keep-alive
    cache-control: private
    set-cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v; path=/
    Cache-Control: no-transform
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/css/stylesin.css
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/css/stylesin.css HTTP/1.1
    Accept: text/css, */*
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: text/css
    Content-Length: 9521
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "e65a97de75f7d9d0d6fcfc0f83e1a0a1"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBA466121A
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#615580025/gid:0/gname:root/mode:33279/mtime:1655385540#62682000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:19:00.062682Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/js/bootstrap-slider.min.js
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/js/bootstrap-slider.min.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: application/javascript
    Content-Length: 26183
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "bb00d9d835171fe905a76787cbea604a"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBABFEDB38
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#623580037/gid:0/gname:root/mode:33279/mtime:1655385541#918685000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:19:01.918685Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-us
    DNS
    155.243.216.195.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    155.243.216.195.in-addr.arpa
    IN PTR
    Response
    155.243.216.195.in-addr.arpa
    IN PTR
    s5uidme
  • flag-us
    DNS
    188.155.64.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    188.155.64.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.184.155.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.184.155.185.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    116.172.5.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    116.172.5.23.in-addr.arpa
    IN PTR
    Response
    116.172.5.23.in-addr.arpa
    IN PTR
    a23-5-172-116deploystaticakamaitechnologiescom
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/css/blue.css
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/css/blue.css HTTP/1.1
    Accept: text/css, */*
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: text/css
    Content-Length: 1505
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "53c8fc393280d00814bfcb0ac9a9948b"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBA90F6413
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#615580025/gid:0/gname:root/mode:33279/mtime:1655385539#562681000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:18:59.562681Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/util/utils.js
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /util/utils.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: application/javascript
    Content-Length: 7512
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "01816d15ca03032751161a746e2fb7c3"
    Last-Modified: Mon, 20 Feb 2023 09:36:45 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576B81812B4E5B
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676885559#334512232/gid:0/gname:root/mode:33188/mtime:1659085489#684136000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-07-29T09:04:49.684136Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/media/exit-new/exit1.js
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/exit-new/exit1.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: application/javascript
    Content-Length: 3473
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "625e5e2950612f771e246beb33c9ea61"
    Last-Modified: Mon, 20 Feb 2023 09:32:43 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576B81B125E760
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#623580037/gid:0/gname:root/mode:33279/mtime:1655385544#182688000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:19:04.182688Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/js/jquery.min.js
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/js/jquery.min.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: application/javascript
    Content-Length: 93435
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "0b6ecf17e30037994d3ffee51b525914"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBA934CF53
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#623580037/gid:0/gname:root/mode:33279/mtime:1655385542#242685000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:19:02.242685Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/cookie/js.cookie.js
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /cookie/js.cookie.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: application/javascript
    Content-Length: 4264
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "a7e9883924072f15259de6888d5ef515"
    Last-Modified: Wed, 31 Aug 2022 09:31:17 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576B8183ABD3A4
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/css/bootstrap-slider.min.css
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/css/bootstrap-slider.min.css HTTP/1.1
    Accept: text/css, */*
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: text/css
    Content-Length: 7227
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "4961224724899c120f62718d9a05a11a"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBAC1174A4
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#615580025/gid:0/gname:root/mode:33279/mtime:1655385539#622681000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:18:59.622681Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/images/radar.gif
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/images/radar.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: image/gif
    Content-Length: 175791
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "0d3a894b7b00a48996f702d71fe7e7c3"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBB2973791
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#619580032/gid:0/gname:root/mode:33279/mtime:1655385540#974683000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:19:00.974683Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/images/in.jpg
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/images/in.jpg HTTP/1.1
    Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: image/jpeg
    Content-Length: 142835
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "5cd215aa3eb2730e115f45b728b8d3c1"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBC3D4BA9B
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#619580032/gid:0/gname:root/mode:33279/mtime:1655385540#646683000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:19:00.646683Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/favicon.ico
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /favicon.ico HTTP/1.1
    Accept: */*
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 204 No Content
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:26 GMT
    Connection: keep-alive
    Cache-Control: no-transform
  • flag-ch
    GET
    https://naughtylady.life/media/d/radarnew/js/bootstrap.min.js
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/d/radarnew/js/bootstrap.min.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: application/javascript
    Content-Length: 29110
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "ba847811448ef90d98d272aeccef2a95"
    Last-Modified: Mon, 20 Feb 2023 09:30:46 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBA92DB891
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843279#623580037/gid:0/gname:root/mode:33279/mtime:1655385542#10685000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:19:02.010685Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-ch
    GET
    https://naughtylady.life/media/bbradar.js
    IEXPLORE.EXE
    Remote address:
    185.155.184.83:443
    Request
    GET /media/bbradar.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: naughtylady.life
    Connection: Keep-Alive
    Cookie: sid=t2~0zgytmi1hc2trqrfcszhe21v
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 19 Apr 2023 19:32:25 GMT
    Content-Type: application/javascript
    Content-Length: 639
    Connection: keep-alive
    Content-Security-Policy: block-all-mixed-content
    ETag: "0d553e4bac91c74bfee2dbabba61e99e"
    Last-Modified: Mon, 20 Feb 2023 09:29:45 GMT
    Strict-Transport-Security: max-age=31536000; includeSubDomains
    Vary: Origin
    Vary: Accept-Encoding
    X-Amz-Request-Id: 17576CEBB2044BAC
    X-Content-Type-Options: nosniff
    X-Xss-Protection: 1; mode=block
    x-amz-meta-mc-attrs: atime:1676843341#395674119/gid:0/gname:root/mode:33279/mtime:1655384793#185591000/uid:0/uname:root
    x-amz-meta-mm-source-mtime: 2022-06-16T13:06:33.185591Z
    Expires: Thu, 18 Apr 2024 19:32:25 GMT
    Cache-Control: max-age=31536000
    Cache-Control: no-transform
    Accept-Ranges: bytes
  • flag-us
    DNS
    176.25.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    176.25.221.88.in-addr.arpa
    IN PTR
    Response
    176.25.221.88.in-addr.arpa
    IN PTR
    a88-221-25-176deploystaticakamaitechnologiescom
  • flag-us
    DNS
    200.232.18.117.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.232.18.117.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • 195.216.243.155:443
    u.to
    tls
    IEXPLORE.EXE
    907 B
     6.0kB
     13
    9
  • 195.216.243.155:443
    https://u.to/gWWCHw
    tls, http
    IEXPLORE.EXE
    1.3kB
     6.7kB
     15
    10

    HTTP Request

    GET https://u.to/gWWCHw

    HTTP Response

    302
  • 185.155.184.83:443
    https://naughtylady.life/media/d/radarnew/js/main.js
    tls, http
    IEXPLORE.EXE
    5.7kB
     122.2kB
     101
    97

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/css/bootstrap.css

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/js/main.js

    HTTP Response

    200
  • 185.155.184.83:443
    https://naughtylady.life/media/d/radarnew/js/bootstrap-slider.min.js
    tls, http
    IEXPLORE.EXE
    4.1kB
     57.3kB
     59
    54

    HTTP Request

    GET https://naughtylady.life/?u=wuwpaew&o=q0l09tt&m=1&t=Ded_1

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/css/stylesin.css

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/js/bootstrap-slider.min.js

    HTTP Response

    200
  • 185.155.184.83:443
    https://naughtylady.life/media/exit-new/exit1.js
    tls, http
    IEXPLORE.EXE
    2.7kB
     16.1kB
     27
    21

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/css/blue.css

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/util/utils.js

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/media/exit-new/exit1.js

    HTTP Response

    200
  • 185.155.184.83:443
    https://naughtylady.life/media/d/radarnew/js/jquery.min.js
    tls, http
    IEXPLORE.EXE
    4.5kB
     98.2kB
     82
    78

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/js/jquery.min.js

    HTTP Response

    200
  • 185.155.184.83:443
    https://naughtylady.life/favicon.ico
    tls, http
    IEXPLORE.EXE
    15.6kB
     347.4kB
     291
    287

    HTTP Request

    GET https://naughtylady.life/cookie/js.cookie.js

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/css/bootstrap-slider.min.css

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/images/radar.gif

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/images/in.jpg

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/favicon.ico

    HTTP Response

    204
  • 185.155.184.83:443
    https://naughtylady.life/media/bbradar.js
    tls, http
    IEXPLORE.EXE
    2.8kB
     33.2kB
     38
    34

    HTTP Request

    GET https://naughtylady.life/media/d/radarnew/js/bootstrap.min.js

    HTTP Response

    200

    HTTP Request

    GET https://naughtylady.life/media/bbradar.js

    HTTP Response

    200
  • 52.152.110.14:443
    260 B
     5
  • 104.208.16.90:443
    322 B
     7
  • 52.152.110.14:443
    260 B
     5
  • 93.184.221.240:80
    322 B
     7
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
     8.1kB
     15
    14
  • 93.184.221.240:80
    322 B
     7
  • 52.152.110.14:443
    260 B
     5
  • 173.223.113.164:443
    322 B
     7
  • 173.223.113.131:80
    322 B
     7
  • 204.79.197.203:80
    api.msn.com
    322 B
     7
  • 52.152.110.14:443
    260 B
     5
  • 52.152.110.14:443
    260 B
     5
  • 52.152.110.14:443
    260 B
     5
  • 8.8.8.8:53
    u.to
    dns
    IEXPLORE.EXE
    50 B
     66 B
     1
    1

    DNS Request

    u.to

    DNS Response

    195.216.243.155

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    naughtylady.life
    dns
    IEXPLORE.EXE
    62 B
     78 B
     1
    1

    DNS Request

    naughtylady.life

    DNS Response

    185.155.184.83

  • 8.8.8.8:53
    155.243.216.195.in-addr.arpa
    dns
    74 B
     97 B
     1
    1

    DNS Request

    155.243.216.195.in-addr.arpa

  • 8.8.8.8:53
    188.155.64.172.in-addr.arpa
    dns
    73 B
     135 B
     1
    1

    DNS Request

    188.155.64.172.in-addr.arpa

  • 8.8.8.8:53
    83.184.155.185.in-addr.arpa
    dns
    73 B
     138 B
     1
    1

    DNS Request

    83.184.155.185.in-addr.arpa

  • 8.8.8.8:53
    116.172.5.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    116.172.5.23.in-addr.arpa

  • 8.8.8.8:53
    176.25.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    176.25.221.88.in-addr.arpa

  • 8.8.8.8:53
    200.232.18.117.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    200.232.18.117.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    2a7fc714134ae90293fce5a1d9697e16

    SHA1

    c29dab1a5e37def81a3406813587a32001925f97

    SHA256

    0145704170fb3888d08d35dcfe2941c6ead410baab0e3552d78a9a402f682aad

    SHA512

    f41495e458a8b7eac03ad9def5278553784ebe35e05a984892a0a078775c472c03a80cb9c00104da9fd18f8f7bf04dd1c1da119514923cde5a4fcb696082f2bf

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    404B

    MD5

    d9038bcdda9c4afab95f8c036c8dacc7

    SHA1

    c1921ecbe77938409d4c2842422aed5f4f3ef4c7

    SHA256

    48dd3bb1867328df774a3a7804e444d2373af06521385e96f8a99739d284de87

    SHA512

    19007e553d504fdbd48ee4522aa2036a49c4ef7a3d3947f6a0e0e914668e57d1e53b53e4c1b5a88249926699d7c09d8b47eec33b1cb8732aeeb8232f9c1a0b98

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RP56V4OA\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.