Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

URLScan

urlscan

1

http://askslinda.com...

windows10-2004-x64

1

Analysis

  • max time kernel
    116s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2023, 13:25 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://askslinda.com/wtGOwhsb2p6.cfml?dQ8S3hcc4hQ6cycffccczQdgc8f0VcSf1cbbb3w

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
    adwarespyware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://askslinda.com/wtGOwhsb2p6.cfml?dQ8S3hcc4hQ6cycffccczQdgc8f0VcSf1cbbb3w
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3984 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3076

Network

  • flag-us
    DNS
    askslinda.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    askslinda.com
    IN A
    Response
    askslinda.com
    IN A
    83.136.50.193
  • flag-us
    GET
    http://askslinda.com/wtGOwhsb2p6.cfml?dQ8S3hcc4hQ6cycffccczQdgc8f0VcSf1cbbb3w
    IEXPLORE.EXE
    Remote address:
    83.136.50.193:80
    Request
    GET /wtGOwhsb2p6.cfml?dQ8S3hcc4hQ6cycffccczQdgc8f0VcSf1cbbb3w HTTP/1.1
    Accept: text/html, application/xhtml+xml, image/jxr, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: askslinda.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Found
    Date: Wed, 31 May 2023 13:25:51 GMT
    Server: Apache
    Location: https://www.sathingcool.com/5ZS8GM1/XXJKG23/?sub1=1_121858_2674415&sub2=1083_3530983_4086883_56&sub3=698804085_154-61-71-13
    Content-Length: 0
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    112.208.253.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    112.208.253.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.sathingcool.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.sathingcool.com
    IN A
    Response
    www.sathingcool.com
    IN A
    154.16.202.14
  • flag-de
    GET
    https://www.sathingcool.com/5ZS8GM1/XXJKG23/?sub1=1_121858_2674415&sub2=1083_3530983_4086883_56&sub3=698804085_154-61-71-13
    IEXPLORE.EXE
    Remote address:
    154.16.202.14:443
    Request
    GET /5ZS8GM1/XXJKG23/?sub1=1_121858_2674415&sub2=1083_3530983_4086883_56&sub3=698804085_154-61-71-13 HTTP/1.1
    Accept: text/html, application/xhtml+xml, image/jxr, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Connection: Keep-Alive
    Host: www.sathingcool.com
    Response
    HTTP/1.1 302 Found
    Server: nginx
    Date: Wed, 31 May 2023 13:25:53 GMT
    Content-Type: text/html; charset=utf-8
    Content-Length: 122
    Accept-Ch: Sec-Ch-Ua-Platform-Version
    Location: https://www.lpredirect.com/24QSBG/DD2G3GQ/?source_id=3080&sub1=592121bbd1bc4921a4e643f987d732ad
    Set-Cookie: uniqueClick_XXJKG23=51a793c4-a3f4-49e2-8e1c-6b581443dc69:1685539553; Path=/; Expires=Wed, 21 Jun 2023 13:25:53 GMT; SameSite=None
    Set-Cookie: transaction_id=592121bbd1bc4921a4e643f987d732ad; Path=/; Expires=Tue, 29 Aug 2023 13:25:53 GMT; SameSite=None
    Vary: Origin
    X-Eflow-Request-Id: 81ece025-a589-4fd4-bdd2-8301458ae9a5
  • flag-de
    DNS
    IEXPLORE.EXE
    Remote address:
    154.16.202.14:443
    Response
    HTTP/1.0 408 Request Time-out
    Cache-Control: no-cache
    Connection: close
    Content-Type: text/html
  • flag-us
    DNS
    193.50.136.83.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    193.50.136.83.in-addr.arpa
    IN PTR
    Response
    193.50.136.83.in-addr.arpa
    IN PTR
    askslindacom
  • flag-us
    DNS
    14.202.16.154.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.202.16.154.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    71.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    71.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    101.15.18.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    101.15.18.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.lpredirect.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.lpredirect.com
    IN A
    Response
    www.lpredirect.com
    IN A
    34.117.79.165
  • flag-us
    GET
    https://www.lpredirect.com/24QSBG/DD2G3GQ/?source_id=3080&sub1=592121bbd1bc4921a4e643f987d732ad
    IEXPLORE.EXE
    Remote address:
    34.117.79.165:443
    Request
    GET /24QSBG/DD2G3GQ/?source_id=3080&sub1=592121bbd1bc4921a4e643f987d732ad HTTP/2.0
    host: www.lpredirect.com
    accept: text/html, application/xhtml+xml, image/jxr, */*
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 302
    server: nginx
    date: Wed, 31 May 2023 13:25:54 GMT
    content-type: text/html; charset=utf-8
    content-length: 165
    accept-ch: Sec-Ch-Ua-Platform-Version
    location: https://removalsearches.com/pQAfWwb5Uj/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    set-cookie: uniqueClick_DD2G3GQ=a35a9dc4-9547-4b0a-b750-2351548a7fb0:1685539554; Path=/; Expires=Thu, 01 Jun 2023 13:25:54 GMT; Secure; SameSite=None
    set-cookie: transaction_id=0f09a10577d04664bde650b9df8737ff; Path=/; Expires=Tue, 29 Aug 2023 13:25:54 GMT; Secure; SameSite=None
    vary: Origin
    x-eflow-request-id: 074148f4-47bc-4096-9388-bcfc5cfcc8d1
    via: 1.1 google
    alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    ocsp.starfieldtech.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    ocsp.starfieldtech.com
    IN A
    Response
    ocsp.starfieldtech.com
    IN CNAME
    ocsp.godaddy.com.akadns.net
    ocsp.godaddy.com.akadns.net
    IN A
    192.124.249.24
    ocsp.godaddy.com.akadns.net
    IN A
    192.124.249.23
    ocsp.godaddy.com.akadns.net
    IN A
    192.124.249.22
    ocsp.godaddy.com.akadns.net
    IN A
    192.124.249.36
    ocsp.godaddy.com.akadns.net
    IN A
    192.124.249.41
  • flag-us
    GET
    http://ocsp.starfieldtech.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D
    IEXPLORE.EXE
    Remote address:
    192.124.249.24:80
    Request
    GET //MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: ocsp.starfieldtech.com
    Response
    HTTP/1.1 200 OK
    Server: Sucuri/Cloudproxy
    Date: Wed, 31 May 2023 13:25:54 GMT
    Content-Type: application/ocsp-response
    Content-Length: 1739
    Connection: keep-alive
    X-Sucuri-ID: 19024
    Content-Transfer-Encoding: Binary
    Cache-Control: public, no-transform, must-revalidate
    Last-Modified: Tue, 30 May 2023 23:20:20 GMT
    Expires: Wed, 31 May 2023 23:20:20 GMT
    ETag: "543696f36d0060dc6732e8e658877efc3dfc0adb"
    P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
    X-Sucuri-Cache: HIT
  • flag-us
    GET
    http://ocsp.starfieldtech.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D
    IEXPLORE.EXE
    Remote address:
    192.124.249.24:80
    Request
    GET //MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: ocsp.starfieldtech.com
    Response
    HTTP/1.1 200 OK
    Server: Sucuri/Cloudproxy
    Date: Wed, 31 May 2023 13:25:54 GMT
    Content-Type: application/ocsp-response
    Content-Length: 1780
    Connection: keep-alive
    X-Sucuri-ID: 19024
    Content-Transfer-Encoding: Binary
    Cache-Control: public, no-transform, must-revalidate
    Last-Modified: Tue, 30 May 2023 20:50:50 GMT
    Expires: Wed, 31 May 2023 20:50:50 GMT
    ETag: "e31070f41095027dc5d9e12da967726a2cca10ba"
    P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
    X-Sucuri-Cache: HIT
  • flag-us
    GET
    http://ocsp.starfieldtech.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQCq6RHr1swIcA%3D%3D
    IEXPLORE.EXE
    Remote address:
    192.124.249.24:80
    Request
    GET //MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQCq6RHr1swIcA%3D%3D HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: ocsp.starfieldtech.com
    Response
    HTTP/1.1 200 OK
    Server: Sucuri/Cloudproxy
    Date: Wed, 31 May 2023 13:25:54 GMT
    Content-Type: application/ocsp-response
    Content-Length: 1846
    Connection: keep-alive
    X-Sucuri-ID: 19024
    Content-Transfer-Encoding: Binary
    Cache-Control: public, no-transform, must-revalidate
    Last-Modified: Tue, 30 May 2023 16:09:22 GMT
    Expires: Wed, 31 May 2023 16:09:22 GMT
    ETag: "24dfe6e34db805c1ff727316b062b246c21af8c5"
    P3P: CP="IDC DSP COR LAW CUR ADM DEV TAI PSA PSD IVA IVD HIS OUR SAM PUB LEG UNI COM NAV STA"
    X-Sucuri-Cache: HIT
  • flag-us
    DNS
    removalsearches.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    removalsearches.com
    IN A
    Response
    removalsearches.com
    IN A
    172.67.149.183
    removalsearches.com
    IN A
    104.21.71.224
  • flag-us
    DNS
    165.79.117.34.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    165.79.117.34.in-addr.arpa
    IN PTR
    Response
    165.79.117.34.in-addr.arpa
    IN PTR
    1657911734bcgoogleusercontentcom
  • flag-us
    DNS
    24.249.124.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    24.249.124.192.in-addr.arpa
    IN PTR
    Response
    24.249.124.192.in-addr.arpa
    IN PTR
    cloudproxy10024sucurinet
  • flag-us
    GET
    https://removalsearches.com/pQAfWwb5Uj/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /pQAfWwb5Uj/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5= HTTP/2.0
    host: removalsearches.com
    accept: text/html, application/xhtml+xml, image/jxr, */*
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 302
    date: Wed, 31 May 2023 13:25:55 GMT
    content-type: text/html
    location: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    set-cookie: SESSIONIDS=pQAfWwb5Uj; Secure; Path=/
    cf-cache-status: DYNAMIC
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kcMhYnvcFdeIuiQkSslE3p%2BUv7n%2B9894VOgyp8PLLjia0N4lKGK%2B9IJNW%2F6jykvMOMI9jhKAe5uEmfSSTMZQZdEjpuRoYDcKMA8aLrezUFCYT6lWIznjzPPJLafHgwPPi3rfCyGf"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    server: cloudflare
    cf-ray: 7cff8baa4fe00b66-AMS
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5= HTTP/2.0
    host: removalsearches.com
    accept: text/html, application/xhtml+xml, image/jxr, */*
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:55 GMT
    content-type: text/html
    last-modified: Sat, 13 May 2023 20:03:15 GMT
    cf-cache-status: DYNAMIC
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a5o5PmzNsS24sC5FDUpsH%2F29pXUDYzx0mA7oCQK6t6jkJ1lVqRkIELLlClXi7QcicJxn2Id2TgvPIXPrK2V7IQuYU%2FnB%2FO2nS9S%2BwfZYetftx8cR99T9Cnxa1lzj6e9oUiwYrVmj"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    server: cloudflare
    cf-ray: 7cff8bad2c390b66-AMS
    content-encoding: gzip
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/css/style.css
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /css/style.css HTTP/2.0
    host: removalsearches.com
    accept: text/css, */*
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: text/css; charset=utf-8
    etag: W/"1149707093"
    last-modified: Sat, 13 May 2023 20:03:07 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OmX4qR9Kh7rMpScE3eKdBJbA4P6vf01zdAfUIyLowVo%2FWCeJ4Eyd6eyS33QazivpmiWMj7vgs%2FO%2F78IQsiwNaZao6b7WefyOemfEROIsNLFx5vCejpDl4vz0Mgvp8BS4aByAZ%2Bne"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb0997e0b66-AMS
    content-encoding: gzip
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/css/animate.min.css
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /css/animate.min.css HTTP/2.0
    host: removalsearches.com
    accept: text/css, */*
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: image/png
    content-length: 17622
    etag: "886492541"
    last-modified: Sat, 13 May 2023 20:03:10 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    accept-ranges: bytes
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S0AboUJh63szPIK4qwRVoUSVz24IqiFf%2B3QeJ4YX7xDT4KIASfnHWxs4A4hoPRFl%2Bo1oiLz8N53wi088QduQ0gK8QyMT4e7XHyzN7hf2mtd%2FDOHWO5IdOG1VJraPy%2B9KkQ%2FmtdyL"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb099850b66-AMS
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/images/logo.png
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /images/logo.png HTTP/2.0
    host: removalsearches.com
    accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: image/png
    content-length: 5093
    etag: "2186080432"
    last-modified: Sat, 13 May 2023 20:03:13 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    accept-ranges: bytes
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tU4gRdV4KvH%2B46Hch31bKsKpFZoeBGG66ZLIYdx%2BmHve5qN0LgTOPwhPrLtaOdyCjYx6nhw8EvRflARE4JjZyuB1NRaNXGxzlaPYu4jKPJpYxUdU7p01k3KJgJafgwtRGLA85iH7"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb099890b66-AMS
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/images/logo2.png
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /images/logo2.png HTTP/2.0
    host: removalsearches.com
    accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: application/javascript
    etag: W/"3561157643"
    last-modified: Sat, 13 May 2023 20:03:05 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=keT02jy%2FSrSigbUNdcpiUCcgrGUIQJXPbfT4jsO1e6YckExoxX3WS9g4ho0pSWJH6oyc%2F6xxiTPzUUGwKszQTuOxYOd2knrwBwD0vmlw8A%2FTjFckH22jNMgmNiTEYontJLRWVtFA"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb0998d0b66-AMS
    content-encoding: gzip
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/images/package.png
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /images/package.png HTTP/2.0
    host: removalsearches.com
    accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: image/png
    content-length: 13555
    etag: "78827991"
    last-modified: Sat, 13 May 2023 20:03:09 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    accept-ranges: bytes
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X7EYgW1DuDXXgwid%2BSO2EzXfb9PR3Meav26QTnWyjEm1VEZSB6ufpiQH9ZclT1AZkjHm9jnOhUsSsqZj0nHs7s3NJRu4VvygEdZEpQ3KF43HPmFUKsbYjsY71mQkZ69uEUgGy1nx"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb0998c0b66-AMS
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/images/loading.gif
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /images/loading.gif HTTP/2.0
    host: removalsearches.com
    accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: image/png
    content-length: 42742
    etag: "48870449"
    last-modified: Sat, 13 May 2023 20:03:13 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    accept-ranges: bytes
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SkSOC%2FGFtxiMaT6rRzQH7hw9pJ5eKCeECRK4hEAF4FschIYZb2vL6LjIQtHCzPfCoJsptd9ufrT0opUsCbiVBuPNMhNH%2BY%2Bq6zzIT%2FOmJvltvYEFkHD07cUDqEyyAWgy31R9vDG3"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb099840b66-AMS
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/images/check.png
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /images/check.png HTTP/2.0
    host: removalsearches.com
    accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: image/gif
    content-length: 185618
    etag: "2494915993"
    last-modified: Sat, 13 May 2023 20:03:15 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    accept-ranges: bytes
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BelmLnrUC9kuC%2FfzSbBJLgVU%2BBMCx3MHi7QDh2JDybJuTwLrAI481NfXHhAeiqVT4XB32qfJZhMacmh08veAQFDbjSbs4kZCxlG1Xr22zhrbFOpuIstH0L3trjHiAowuzJAs6EQA"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb099880b66-AMS
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/images/product.png
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /images/product.png HTTP/2.0
    host: removalsearches.com
    accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: text/css; charset=utf-8
    etag: W/"3136134899"
    last-modified: Sat, 13 May 2023 20:03:08 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CKlb%2FXzfaTLmq2IKv1Uh%2Bje1w3v4z0bThC7mB7R%2BbfzcWBHgt5DTLIuXb4OftCR6AvsXC7l9AHOIsQ57G5eJqlOCvBlzGXxi6eX3KYOKAvplfG%2Fo9k%2BFutirZlVGluNhbJDEs25T"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb0997d0b66-AMS
    content-encoding: gzip
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/js/script.js
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /js/script.js HTTP/2.0
    host: removalsearches.com
    accept: application/javascript, */*;q=0.8
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: image/png
    content-length: 41565
    etag: "2703706020"
    last-modified: Sat, 13 May 2023 20:03:11 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    accept-ranges: bytes
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Oc4Xom79dr9WBn%2BH2aB%2BobomN2SDNmJoGDrBfnWtfuvxLQry53aeargVkWMa3tRMl8nT%2F7PkqE1vs0X2DHyD59gr6joem5TgpW4c0BnBq1hgCecogETqy3Te4dOyxLIbCWLNNMne"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb099830b66-AMS
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://removalsearches.com/css/comp.ico
    IEXPLORE.EXE
    Remote address:
    172.67.149.183:443
    Request
    GET /css/comp.ico HTTP/2.0
    host: removalsearches.com
    accept: */*
    accept-encoding: gzip, deflate
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    cookie: SESSIONIDS=pQAfWwb5Uj
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:57 GMT
    content-type: image/vnd.microsoft.icon
    etag: W/"1122444379"
    last-modified: Sat, 13 May 2023 20:03:07 GMT
    cache-control: max-age=14400
    cf-cache-status: REVALIDATED
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q32f%2BRU9fOm7nn0yZ%2FbNjJvqKAdsEe9LLaUvA8C5BDTTXzy0QX4YkNuoWXRLnluFZAv%2F0ohzaLa4pngLbE%2BurlSSzzFeAMGmJZkizRD2dX7%2BTXSZOWzboN2tCHNGR1Aq%2FM7PdNky"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bba48c40b66-AMS
    content-encoding: gzip
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    x2.c.lencr.org
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    x2.c.lencr.org
    IN A
    Response
    x2.c.lencr.org
    IN CNAME
    crl.root-x1.letsencrypt.org.edgekey.net
    crl.root-x1.letsencrypt.org.edgekey.net
    IN CNAME
    e8652.dscx.akamaiedge.net
    e8652.dscx.akamaiedge.net
    IN A
    23.52.55.67
  • flag-nl
    GET
    http://x2.c.lencr.org/
    IEXPLORE.EXE
    Remote address:
    23.52.55.67:80
    Request
    GET / HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: x2.c.lencr.org
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Content-Type: application/pkix-crl
    Last-Modified: Sat, 15 Apr 2023 00:28:13 GMT
    ETag: "6439ef9d-12c"
    Cache-Control: max-age=3600
    Expires: Wed, 31 May 2023 14:25:54 GMT
    Date: Wed, 31 May 2023 13:25:54 GMT
    Content-Length: 300
    Connection: keep-alive
  • flag-us
    DNS
    183.149.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.149.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    67.55.52.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.55.52.23.in-addr.arpa
    IN PTR
    Response
    67.55.52.23.in-addr.arpa
    IN PTR
    a23-52-55-67deploystaticakamaitechnologiescom
  • flag-us
    DNS
    virtualpushplatform.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    virtualpushplatform.com
    IN A
    Response
    virtualpushplatform.com
    IN A
    172.67.177.88
    virtualpushplatform.com
    IN A
    104.21.67.146
  • flag-us
    GET
    https://virtualpushplatform.com/ace-push.js
    IEXPLORE.EXE
    Remote address:
    172.67.177.88:443
    Request
    GET /ace-push.js HTTP/2.0
    host: virtualpushplatform.com
    accept: application/javascript, */*;q=0.8
    referer: https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    date: Wed, 31 May 2023 13:25:56 GMT
    content-type: text/javascript
    cf-bgj: minify
    cf-polished: origSize=13985
    etag: W/"1d968b16d83d4a1"
    last-modified: Thu, 06 Apr 2023 17:58:44 GMT
    cache-control: max-age=3600
    cf-cache-status: HIT
    age: 2765
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nWhTGde274VA9tJ4WqNUTEcrcvQNx19JnMaBtprl%2B03i93sB0dVT1FQnWow6V0dhZ9rdD6hC31A88%2Bva%2FczLKrDiuV9%2BwxS%2FJGOiuMZZRmtuZGRORYyeN%2FMAqRmBJWa7NXm3hLHkRHxHSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 7cff8bb23d6d1c08-AMS
    content-encoding: gzip
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    88.177.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.177.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    161.19.199.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    161.19.199.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    139.238.32.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    139.238.32.23.in-addr.arpa
    IN PTR
    Response
    139.238.32.23.in-addr.arpa
    IN PTR
    a23-32-238-139deploystaticakamaitechnologiescom
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    121.252.72.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    121.252.72.23.in-addr.arpa
    IN PTR
    Response
    121.252.72.23.in-addr.arpa
    IN PTR
    a23-72-252-121deploystaticakamaitechnologiescom
  • flag-us
    DNS
    121.252.72.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    121.252.72.23.in-addr.arpa
    IN PTR
    Response
    121.252.72.23.in-addr.arpa
    IN PTR
    a23-72-252-121deploystaticakamaitechnologiescom
  • 83.136.50.193:80
    http://askslinda.com/wtGOwhsb2p6.cfml?dQ8S3hcc4hQ6cycffccczQdgc8f0VcSf1cbbb3w
    http
    IEXPLORE.EXE
    592 B
     500 B
     6
    5

    HTTP Request

    GET http://askslinda.com/wtGOwhsb2p6.cfml?dQ8S3hcc4hQ6cycffccczQdgc8f0VcSf1cbbb3w

    HTTP Response

    302
  • 83.136.50.193:80
    askslinda.com
    IEXPLORE.EXE
    242 B
     184 B
     5
    4
  • 154.16.202.14:443
    https://www.sathingcool.com/5ZS8GM1/XXJKG23/?sub1=1_121858_2674415&sub2=1083_3530983_4086883_56&sub3=698804085_154-61-71-13
    tls, http
    IEXPLORE.EXE
    1.4kB
     7.6kB
     16
    10

    HTTP Request

    GET https://www.sathingcool.com/5ZS8GM1/XXJKG23/?sub1=1_121858_2674415&sub2=1083_3530983_4086883_56&sub3=698804085_154-61-71-13

    HTTP Response

    302
  • 154.16.202.14:443
    www.sathingcool.com
    tls, http
    IEXPLORE.EXE
    1.0kB
     7.0kB
     15
    10

    HTTP Response

    408
  • 34.117.79.165:443
    www.lpredirect.com
    tls, http2
    IEXPLORE.EXE
    1.1kB
     7.5kB
     16
    12
  • 34.117.79.165:443
    https://www.lpredirect.com/24QSBG/DD2G3GQ/?source_id=3080&sub1=592121bbd1bc4921a4e643f987d732ad
    tls, http2
    IEXPLORE.EXE
    1.7kB
     8.6kB
     22
    18

    HTTP Request

    GET https://www.lpredirect.com/24QSBG/DD2G3GQ/?source_id=3080&sub1=592121bbd1bc4921a4e643f987d732ad

    HTTP Response

    302
  • 192.124.249.24:80
    http://ocsp.starfieldtech.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQCq6RHr1swIcA%3D%3D
    http
    IEXPLORE.EXE
    1.2kB
     7.4kB
     11
    10

    HTTP Request

    GET http://ocsp.starfieldtech.com//MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCAzkUhA%3D%3D

    HTTP Response

    200

    HTTP Request

    GET http://ocsp.starfieldtech.com//MEIwQDA%2BMDwwOjAJBgUrDgMCGgUABBQUwPiEZQ6%2FsVZNPaFToNfxx8ZwqAQUfAwyH6fZMH%2FEfWijYqihzqsHWycCAQc%3D

    HTTP Response

    200

    HTTP Request

    GET http://ocsp.starfieldtech.com//MEowSDBGMEQwQjAJBgUrDgMCGgUABBT1ZqtwV0O1KcYi0gdzcFkHM%2BuArAQUJUWBaFAmOD07LSy%2BzWrZtj2zZmMCCQCq6RHr1swIcA%3D%3D

    HTTP Response

    200
  • 172.67.149.183:443
    https://removalsearches.com/css/comp.ico
    tls, http2
    IEXPLORE.EXE
    14.3kB
     340.8kB
     278
    274

    HTTP Request

    GET https://removalsearches.com/pQAfWwb5Uj/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=

    HTTP Response

    302

    HTTP Request

    GET https://removalsearches.com/?encoded_value=24QSBG&sub1=592121bbd1bc4921a4e643f987d732ad&sub2=&sub3=&sub4=&sub5=

    HTTP Response

    200

    HTTP Request

    GET https://removalsearches.com/css/style.css

    HTTP Request

    GET https://removalsearches.com/css/animate.min.css

    HTTP Request

    GET https://removalsearches.com/images/logo.png

    HTTP Request

    GET https://removalsearches.com/images/logo2.png

    HTTP Request

    GET https://removalsearches.com/images/package.png

    HTTP Request

    GET https://removalsearches.com/images/loading.gif

    HTTP Request

    GET https://removalsearches.com/images/check.png

    HTTP Request

    GET https://removalsearches.com/images/product.png

    HTTP Request

    GET https://removalsearches.com/js/script.js

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://removalsearches.com/css/comp.ico

    HTTP Response

    200
  • 172.67.149.183:443
    removalsearches.com
    tls, http2
    IEXPLORE.EXE
    1.1kB
     5.6kB
     15
    11
  • 23.52.55.67:80
    http://x2.c.lencr.org/
    http
    IEXPLORE.EXE
    391 B
     761 B
     6
    4

    HTTP Request

    GET http://x2.c.lencr.org/

    HTTP Response

    200
  • 172.67.177.88:443
    https://virtualpushplatform.com/ace-push.js
    tls, http2
    IEXPLORE.EXE
    1.5kB
     8.5kB
     19
    14

    HTTP Request

    GET https://virtualpushplatform.com/ace-push.js

    HTTP Response

    200
  • 172.67.177.88:443
    virtualpushplatform.com
    tls, http2
    IEXPLORE.EXE
    1.1kB
     3.6kB
     14
    10
  • 20.50.73.11:443
    322 B
     7
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
     8.1kB
     15
    14
  • 8.8.8.8:53
    askslinda.com
    dns
    IEXPLORE.EXE
    59 B
     75 B
     1
    1

    DNS Request

    askslinda.com

    DNS Response

    83.136.50.193

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    112.208.253.8.in-addr.arpa
    dns
    72 B
     126 B
     1
    1

    DNS Request

    112.208.253.8.in-addr.arpa

  • 8.8.8.8:53
    www.sathingcool.com
    dns
    IEXPLORE.EXE
    65 B
     81 B
     1
    1

    DNS Request

    www.sathingcool.com

    DNS Response

    154.16.202.14

  • 8.8.8.8:53
    193.50.136.83.in-addr.arpa
    dns
    72 B
     99 B
     1
    1

    DNS Request

    193.50.136.83.in-addr.arpa

  • 8.8.8.8:53
    14.202.16.154.in-addr.arpa
    dns
    72 B
     141 B
     1
    1

    DNS Request

    14.202.16.154.in-addr.arpa

  • 8.8.8.8:53
    71.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    71.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    101.15.18.104.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    101.15.18.104.in-addr.arpa

  • 8.8.8.8:53
    www.lpredirect.com
    dns
    IEXPLORE.EXE
    64 B
     80 B
     1
    1

    DNS Request

    www.lpredirect.com

    DNS Response

    34.117.79.165

  • 8.8.8.8:53
    ocsp.starfieldtech.com
    dns
    IEXPLORE.EXE
    68 B
     189 B
     1
    1

    DNS Request

    ocsp.starfieldtech.com

    DNS Response

    192.124.249.24
    192.124.249.23
    192.124.249.22
    192.124.249.36
    192.124.249.41

  • 8.8.8.8:53
    removalsearches.com
    dns
    IEXPLORE.EXE
    65 B
     97 B
     1
    1

    DNS Request

    removalsearches.com

    DNS Response

    172.67.149.183
    104.21.71.224

  • 8.8.8.8:53
    165.79.117.34.in-addr.arpa
    dns
    72 B
     124 B
     1
    1

    DNS Request

    165.79.117.34.in-addr.arpa

  • 8.8.8.8:53
    24.249.124.192.in-addr.arpa
    dns
    73 B
     113 B
     1
    1

    DNS Request

    24.249.124.192.in-addr.arpa

  • 8.8.8.8:53
    x2.c.lencr.org
    dns
    IEXPLORE.EXE
    60 B
     165 B
     1
    1

    DNS Request

    x2.c.lencr.org

    DNS Response

    23.52.55.67

  • 8.8.8.8:53
    183.149.67.172.in-addr.arpa
    dns
    73 B
     135 B
     1
    1

    DNS Request

    183.149.67.172.in-addr.arpa

  • 8.8.8.8:53
    67.55.52.23.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    67.55.52.23.in-addr.arpa

  • 8.8.8.8:53
    virtualpushplatform.com
    dns
    IEXPLORE.EXE
    69 B
     101 B
     1
    1

    DNS Request

    virtualpushplatform.com

    DNS Response

    172.67.177.88
    104.21.67.146

  • 8.8.8.8:53
    88.177.67.172.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    88.177.67.172.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    161.19.199.152.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    161.19.199.152.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    139.238.32.23.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    139.238.32.23.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    146 B
     212 B
     2
    2

    DNS Request

    200.197.79.204.in-addr.arpa

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    121.252.72.23.in-addr.arpa
    dns
    144 B
     274 B
     2
    2

    DNS Request

    121.252.72.23.in-addr.arpa

    DNS Request

    121.252.72.23.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    080320bb3fe7e7f860019942e6f77f9c

    SHA1

    2d6f3813b1ed7972c01df6330eb3b0c30339eda9

    SHA256

    9eb11d5a62c35054e50d193211638a08c9b94d5b360f943df4124e28ab793a6f

    SHA512

    9def7fa57fc58af72dc374f0ca010107585a355ffcb3c1d3b99064a455acf3fe8ed7d42052234fe2d042b5ccda8af4ba16a8b2dd882b01f0be7edb8cf7aa8944

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    404B

    MD5

    5a251d8ef0167cbf8e6004ffe3532be3

    SHA1

    43e5d53e2f4eb33150c930efdab5a109a2dd1685

    SHA256

    afdef2411def62f0687cb48957b155aa79c1cdaf7246c42e6e17a76e26f89fb7

    SHA512

    edab5783720ff907ec7de1094d5d4235d17e1a497e06923b93a1f3afa1d64b5cca9faf00247bc3fbf179211dc82d57ceb28d54ec64d5d8d3c1f26c063b441029

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\osplltc\imagestore.dat
    Filesize

    916B

    MD5

    2821fb34580b6547cca39cf727c84de4

    SHA1

    f077e7a1d2413e1c1bf6b27c50de32c90cde8e7f

    SHA256

    9f3a3168bf2ed975c84fc29adbfc723aa4078b0f9b2c4d44bb0f641c351ab6c2

    SHA512

    3f9ce3e3b24fb28fa854c853158aac36e67d1eaccfdc26cc21eb9ce9570ef65443ee17ba923b5e39fd7569e9bd25b0be67f417905b572a5a8e47d4f1ec6473c6

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\comp[1].ico
    Filesize

    790B

    MD5

    62d62c742a38bff81b947bbc044ee0df

    SHA1

    235df298a502490a9d1de228c111f926723b4374

    SHA256

    b6dca73341ce0ea741c5680c928360b32484b3df26f4eac23ccac1b61de03343

    SHA512

    138fbe5f67bb19ea8eeec5ba891cf727245fdaf4b6af9748d73bdaff84d9e4c80d85076ee3c6cead7f2b3a4c09dcaf4a801f92a7f0363509c817b5bae3243dfc

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.