Overview

overview

1

Static

static

1

8f7026aa27...5.html

windows7-x64

1

8f7026aa27...5.html

windows10-2004-x64

1

Analysis

  • max time kernel
    88s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 14:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8f7026aa273f7e2af194f47089db3a05.html

  • Size

    3.5MB

  • MD5

    8f7026aa273f7e2af194f47089db3a05

  • SHA1

    6e653370aa66b7ac16a0da5da38fddf5acf81026

  • SHA256

    6a51ec2e26d555848f9709593fbf822bbd686d7f69688209ac38bbd30f719448

  • SHA512

    dba7f604acd81838c1329f8d17ca78ade6267245901967d299665f0e9336f5e692bad3ec1f4366a8e7ff07ef5f3efecbfb67c705d8768465a9152a24250569d1

  • SSDEEP

    12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NSy:jvpjte4tT64y

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8f7026aa273f7e2af194f47089db3a05.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:368 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2700

Network

  • flag-us
    DNS
    static.cloudflareinsights.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    static.cloudflareinsights.com
    IN A
    Response
    static.cloudflareinsights.com
    IN A
    104.16.56.101
    static.cloudflareinsights.com
    IN A
    104.16.57.101
  • flag-us
    GET
    https://static.cloudflareinsights.com/beacon.min.js
    IEXPLORE.EXE
    Remote address:
    104.16.56.101:443
    Request
    GET /beacon.min.js HTTP/2.0
    host: static.cloudflareinsights.com
    accept: application/javascript, */*;q=0.8
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    date: Sun, 04 Feb 2024 14:55:16 GMT
    content-type: text/javascript;charset=UTF-8
    access-control-allow-origin: *
    cache-control: public, max-age=86400
    etag: W/"2023.10.0"
    last-modified: Tue, 10 Oct 2023 21:38:13 GMT
    cross-origin-resource-policy: cross-origin
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 8503c0f11c196538-LHR
    content-encoding: gzip
  • flag-us
    DNS
    ajax.googleapis.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    ajax.googleapis.com
    IN A
    Response
    ajax.googleapis.com
    IN A
    142.250.200.10
  • flag-gb
    GET
    https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
    IEXPLORE.EXE
    Remote address:
    142.250.200.10:443
    Request
    GET /ajax/libs/jquery/2.2.4/jquery.min.js HTTP/2.0
    host: ajax.googleapis.com
    accept: application/javascript, */*;q=0.8
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    accept-ranges: bytes
    content-encoding: gzip
    access-control-allow-origin: *
    content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
    cross-origin-resource-policy: cross-origin
    cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
    report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
    timing-allow-origin: *
    content-length: 30028
    x-content-type-options: nosniff
    server: sffe
    x-xss-protection: 0
    date: Fri, 02 Feb 2024 21:38:19 GMT
    expires: Sat, 01 Feb 2025 21:38:19 GMT
    cache-control: public, max-age=31536000, stale-while-revalidate=2592000
    last-modified: Tue, 03 Mar 2020 19:15:00 GMT
    content-type: text/javascript; charset=UTF-8
    vary: Accept-Encoding
    age: 148618
    alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    101.56.16.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    101.56.16.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    code.jquery.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    code.jquery.com
    IN A
    Response
    code.jquery.com
    IN A
    151.101.66.137
    code.jquery.com
    IN A
    151.101.130.137
    code.jquery.com
    IN A
    151.101.194.137
    code.jquery.com
    IN A
    151.101.2.137
  • flag-us
    GET
    https://code.jquery.com/jquery-3.1.1.min.js
    IEXPLORE.EXE
    Remote address:
    151.101.66.137:443
    Request
    GET /jquery-3.1.1.min.js HTTP/2.0
    host: code.jquery.com
    accept: application/javascript, */*;q=0.8
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    server: nginx
    content-type: application/javascript; charset=utf-8
    last-modified: Fri, 18 Oct 1991 12:00:00 GMT
    etag: W/"28feccc0-152b5"
    cache-control: public, max-age=31536000, stale-while-revalidate=604800
    access-control-allow-origin: *
    content-encoding: gzip
    via: 1.1 varnish, 1.1 varnish
    accept-ranges: bytes
    date: Sun, 04 Feb 2024 14:55:17 GMT
    age: 12257916
    x-served-by: cache-lga21947-LGA, cache-lhr7343-LHR
    x-cache: HIT, HIT
    x-cache-hits: 125, 42482
    x-timer: S1707058518.680094,VS0,VE0
    vary: Accept-Encoding
    content-length: 30070
  • flag-us
    GET
    https://code.jquery.com/jquery-3.2.1.slim.min.js
    IEXPLORE.EXE
    Remote address:
    151.101.66.137:443
    Request
    GET /jquery-3.2.1.slim.min.js HTTP/2.0
    host: code.jquery.com
    accept: application/javascript, */*;q=0.8
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    origin: file:
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    server: nginx
    content-type: application/javascript; charset=utf-8
    last-modified: Fri, 18 Oct 1991 12:00:00 GMT
    etag: W/"28feccc0-10fdd"
    cache-control: public, max-age=31536000, stale-while-revalidate=604800
    access-control-allow-origin: *
    content-encoding: gzip
    via: 1.1 varnish, 1.1 varnish
    accept-ranges: bytes
    date: Sun, 04 Feb 2024 14:55:20 GMT
    age: 12154719
    x-served-by: cache-lga21963-LGA, cache-lhr7343-LHR
    x-cache: HIT, HIT
    x-cache-hits: 7, 65262
    x-timer: S1707058520.349418,VS0,VE0
    vary: Accept-Encoding
    content-length: 23856
  • flag-us
    DNS
    79.121.231.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    79.121.231.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    201.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    201.178.17.96.in-addr.arpa
    IN PTR
    Response
    201.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-201deploystaticakamaitechnologiescom
  • flag-us
    DNS
    10.200.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.200.250.142.in-addr.arpa
    IN PTR
    Response
    10.200.250.142.in-addr.arpa
    IN PTR
    lhr48s29-in-f101e100net
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    3.178.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    3.178.250.142.in-addr.arpa
    IN PTR
    Response
    3.178.250.142.in-addr.arpa
    IN PTR
    lhr48s27-in-f31e100net
  • flag-us
    DNS
    137.66.101.151.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    137.66.101.151.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.149.64.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.149.64.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    233.38.18.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    233.38.18.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    maxcdn.bootstrapcdn.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    maxcdn.bootstrapcdn.com
    IN A
    Response
    maxcdn.bootstrapcdn.com
    IN A
    104.18.10.207
    maxcdn.bootstrapcdn.com
    IN A
    104.18.11.207
  • flag-us
    GET
    https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css
    IEXPLORE.EXE
    Remote address:
    104.18.10.207:443
    Request
    GET /bootstrap/4.0.0/css/bootstrap.min.css HTTP/2.0
    host: maxcdn.bootstrapcdn.com
    accept: text/css, */*
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    date: Sun, 04 Feb 2024 14:55:19 GMT
    content-type: text/css; charset=utf-8
    vary: Accept-Encoding
    cdn-pullzone: 252412
    cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
    cdn-requestcountrycode: FR
    access-control-allow-origin: *
    cache-control: public, max-age=31919000
    content-encoding: gzip
    etag: W/"450fc463b8b1a349df717056fbb3e078"
    last-modified: Mon, 25 Jan 2021 22:04:04 GMT
    cdn-cachedat: 11/23/2023 10:15:26
    cdn-proxyver: 1.04
    cdn-requestpullcode: 200
    cdn-requestpullsuccess: True
    cdn-edgestorageid: 946
    timing-allow-origin: *
    cross-origin-resource-policy: cross-origin
    x-content-type-options: nosniff
    cdn-status: 200
    cdn-requestid: d9b7ababe2fcb946f25bd60ef88cb64d
    cdn-cache: HIT
    cf-cache-status: HIT
    age: 5653182
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    server: cloudflare
    cf-ray: 8503c100fb1d71a8-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
    IEXPLORE.EXE
    Remote address:
    104.18.10.207:443
    Request
    GET /bootstrap/4.0.0/js/bootstrap.min.js HTTP/2.0
    host: maxcdn.bootstrapcdn.com
    accept: application/javascript, */*;q=0.8
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    origin: file:
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    date: Sun, 04 Feb 2024 14:55:20 GMT
    content-type: application/javascript; charset=utf-8
    vary: Accept-Encoding
    cdn-pullzone: 252412
    cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
    cdn-requestcountrycode: FR
    access-control-allow-origin: *
    cache-control: public, max-age=31919000
    content-encoding: gzip
    etag: W/"14d449eb8876fa55e1ef3c2cc52b0c17"
    last-modified: Mon, 25 Jan 2021 22:04:04 GMT
    cdn-cachedat: 10/31/2023 19:43:16
    cdn-proxyver: 1.04
    cdn-requestpullcode: 200
    cdn-requestpullsuccess: True
    cdn-edgestorageid: 951
    timing-allow-origin: *
    cross-origin-resource-policy: cross-origin
    x-content-type-options: nosniff
    cdn-status: 200
    cdn-requestid: 58c4d2a17abe72bd8d781d31d184e375
    cdn-cache: HIT
    cf-cache-status: HIT
    age: 4131826
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    server: cloudflare
    cf-ray: 8503c10a195971a8-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    207.10.18.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    207.10.18.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    kit.fontawesome.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    kit.fontawesome.com
    IN A
    Response
    kit.fontawesome.com
    IN CNAME
    kit.fontawesome.com.cdn.cloudflare.net
    kit.fontawesome.com.cdn.cloudflare.net
    IN A
    104.18.40.68
    kit.fontawesome.com.cdn.cloudflare.net
    IN A
    172.64.147.188
  • flag-us
    GET
    https://kit.fontawesome.com/585b051251.js
    IEXPLORE.EXE
    Remote address:
    104.18.40.68:443
    Request
    GET /585b051251.js HTTP/2.0
    host: kit.fontawesome.com
    accept: application/javascript, */*;q=0.8
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    origin: file:
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    date: Sun, 04 Feb 2024 14:55:20 GMT
    content-type: text/javascript
    access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
    access-control-allow-methods: GET, OPTIONS
    access-control-allow-origin: *
    access-control-max-age: 3000
    cache-control: max-age=60, public, stale-while-revalidate=30
    vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
    x-request-id: F6_iT5mFbYA1ofZBlSAh
    cf-cache-status: REVALIDATED
    server: cloudflare
    cf-ray: 8503c104f8e6dc49-LHR
    content-encoding: gzip
  • flag-us
    DNS
    ka-f.fontawesome.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    ka-f.fontawesome.com
    IN A
    Response
    ka-f.fontawesome.com
    IN CNAME
    ka-f.fontawesome.com.cdn.cloudflare.net
    ka-f.fontawesome.com.cdn.cloudflare.net
    IN A
    172.64.165.7
    ka-f.fontawesome.com.cdn.cloudflare.net
    IN A
    172.64.164.7
  • flag-us
    GET
    https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251
    IEXPLORE.EXE
    Remote address:
    172.64.165.7:443
    Request
    GET /releases/v5.15.4/css/free.min.css?token=585b051251 HTTP/2.0
    host: ka-f.fontawesome.com
    accept: */*
    accept-language: en-US
    accept-encoding: gzip, deflate
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Response
    HTTP/2.0 200
    date: Sun, 04 Feb 2024 14:55:20 GMT
    content-type: text/css
    access-control-allow-origin: *
    access-control-allow-methods: GET
    access-control-max-age: 3000
    last-modified: Wed, 04 Aug 2021 18:53:09 GMT
    etag: W/"a12ec7ebe75a4d59a5dd6b79e2ba2e16"
    cache-control: max-age=31556926
    access-control-allow-headers: fa-kit-token
    content-encoding: gzip
    vary: Accept-Encoding
    x-cache: Hit from cloudfront
    via: 1.1 b25a88361ae631ab0435a1c107ccf948.cloudfront.net (CloudFront)
    x-amz-cf-pop: LHR5-P6
    x-amz-cf-id: tSbRUxtgJpVtSzogD7AtH6GBOG77fwYfdY6p-FNpaJNS_x5sFe5peg==
    age: 3953208
    cf-cache-status: HIT
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X2dnXmBdXML15xRdbupAlYrLPcZw%2B5FnTXsVGNrFUVMJiWxetLLX6WQVKbBpkjFlQ5PDzDfWyex1M1d82ackRJNoMTS%2BLAvokeSd%2FvaNhIpUvyhuTy9kdE5Ql3G1QtW%2FVedd2oJfpg%3D%3D"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    server: cloudflare
    cf-ray: 8503c108de34776d-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    GET
    https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
    IEXPLORE.EXE
    Remote address:
    172.64.165.7:443
    Request
    GET /releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251 HTTP/2.0
    host: ka-f.fontawesome.com
    accept: */*
    accept-language: en-US
    accept-encoding: gzip, deflate
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Response
    HTTP/2.0 200
    date: Sun, 04 Feb 2024 14:55:20 GMT
    content-type: text/css
    access-control-allow-origin: *
    access-control-allow-methods: GET
    access-control-max-age: 3000
    last-modified: Wed, 04 Aug 2021 18:53:09 GMT
    etag: W/"76f34b71fc9fb641507ff6a822cc07f5"
    cache-control: max-age=31556926
    access-control-allow-headers: fa-kit-token
    content-encoding: gzip
    vary: Accept-Encoding
    x-cache: Hit from cloudfront
    via: 1.1 9438e1326f4ba7255618d848e9c0f7f2.cloudfront.net (CloudFront)
    x-amz-cf-pop: LHR5-P6
    x-amz-cf-id: b8F30fSCR17SxZjS2VZRuI0iegYAyPG3SzIG0KBADoT9CxM3ED78lA==
    age: 3919507
    cf-cache-status: HIT
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VRNRJrsFTUoSjDG8RU30F6rdhQt3Lzsa%2ByXdDhtHHGLfn9R55qfvDQAAEiPlYQSIRT8a0jqPVd7UlBlHc%2BnVMHYZ%2BKzcZAvKbuyVvo3s6RW%2FMVPO%2B6XZOTQDDBOBIGxSRaTIBzLr4A%3D%3D"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    server: cloudflare
    cf-ray: 8503c108de37776d-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    10.180.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.180.250.142.in-addr.arpa
    IN PTR
    Response
    10.180.250.142.in-addr.arpa
    IN PTR
    lhr25s32-in-f101e100net
  • flag-us
    DNS
    68.40.18.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.40.18.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    cdnjs.cloudflare.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    cdnjs.cloudflare.com
    IN A
    Response
    cdnjs.cloudflare.com
    IN A
    104.17.24.14
    cdnjs.cloudflare.com
    IN A
    104.17.25.14
  • flag-us
    GET
    https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
    IEXPLORE.EXE
    Remote address:
    104.17.24.14:443
    Request
    GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/2.0
    host: cdnjs.cloudflare.com
    accept: application/javascript, */*;q=0.8
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    origin: file:
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    date: Sun, 04 Feb 2024 14:55:20 GMT
    content-type: application/javascript; charset=utf-8
    content-length: 6908
    access-control-allow-origin: *
    cache-control: public, max-age=30672000
    content-encoding: gzip
    etag: "5eb03fa9-4af4"
    last-modified: Mon, 04 May 2020 16:15:37 GMT
    cf-cdnjs-via: cfworker/kv
    cross-origin-resource-policy: cross-origin
    timing-allow-origin: *
    x-content-type-options: nosniff
    vary: Accept-Encoding
    cf-cache-status: HIT
    age: 142166
    expires: Fri, 24 Jan 2025 14:55:20 GMT
    accept-ranges: bytes
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=su9dn2hLes2I1OrxIRWyQRflKvDx%2Bs%2FMJw6%2BFaRwKbNYOqvoTHkd93r3p1BzvBgmtUr9I2JjUzxx0qWXvL%2BXL3JQYdJKJRDIcwckVxHA3aF1%2F0GW55Va5E4sEHoFHjNOx7hE8OEM"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
    strict-transport-security: max-age=15780000
    server: cloudflare
    cf-ray: 8503c109785923b3-LHR
    alt-svc: h3=":443"; ma=86400
  • flag-us
    DNS
    7.165.64.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    7.165.64.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.24.17.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.24.17.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    161.19.199.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    161.19.199.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.134.221.88.in-addr.arpa
    IN PTR
    Response
    18.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-18deploystaticakamaitechnologiescom
  • flag-us
    DNS
    18.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.134.221.88.in-addr.arpa
    IN PTR
    Response
    18.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-18deploystaticakamaitechnologiescom
  • flag-us
    DNS
    192.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    192.178.17.96.in-addr.arpa
    IN PTR
    Response
    192.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-192deploystaticakamaitechnologiescom
  • flag-us
    DNS
    192.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    192.178.17.96.in-addr.arpa
    IN PTR
    Response
    192.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-192deploystaticakamaitechnologiescom
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 104.16.56.101:443
    static.cloudflareinsights.com
    tls, http2
    IEXPLORE.EXE
    1.0kB
     3.6kB
     13
    9
  • 104.16.56.101:443
    https://static.cloudflareinsights.com/beacon.min.js
    tls, http2
    IEXPLORE.EXE
    1.8kB
     11.4kB
     27
    22

    HTTP Request

    GET https://static.cloudflareinsights.com/beacon.min.js

    HTTP Response

    200
  • 142.250.200.10:443
    https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
    tls, http2
    IEXPLORE.EXE
    2.5kB
     37.8kB
     41
    35

    HTTP Request

    GET https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js

    HTTP Response

    200
  • 142.250.200.10:443
    ajax.googleapis.com
    tls, http2
    IEXPLORE.EXE
    1.1kB
     5.5kB
     15
    11
  • 151.101.66.137:443
    https://code.jquery.com/jquery-3.2.1.slim.min.js
    tls, http2
    IEXPLORE.EXE
    3.4kB
     63.9kB
     61
    60

    HTTP Request

    GET https://code.jquery.com/jquery-3.1.1.min.js

    HTTP Response

    200

    HTTP Request

    GET https://code.jquery.com/jquery-3.2.1.slim.min.js

    HTTP Response

    200
  • 151.101.66.137:443
    code.jquery.com
    tls, http2
    IEXPLORE.EXE
    1.1kB
     6.4kB
     16
    15
  • 104.18.10.207:443
    maxcdn.bootstrapcdn.com
    tls, http2
    IEXPLORE.EXE
    1.1kB
     5.9kB
     14
    10
  • 104.18.10.207:443
    https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
    tls, http2
    IEXPLORE.EXE
    3.4kB
     49.6kB
     58
    51

    HTTP Request

    GET https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/css/bootstrap.min.css

    HTTP Response

    200

    HTTP Request

    GET https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js

    HTTP Response

    200
  • 104.18.40.68:443
    https://kit.fontawesome.com/585b051251.js
    tls, http2
    IEXPLORE.EXE
    1.5kB
     9.9kB
     21
    17

    HTTP Request

    GET https://kit.fontawesome.com/585b051251.js

    HTTP Response

    200
  • 104.18.40.68:443
    kit.fontawesome.com
    tls, http2
    IEXPLORE.EXE
    1.0kB
     4.7kB
     13
    9
  • 172.64.165.7:443
    ka-f.fontawesome.com
    tls, http2
    IEXPLORE.EXE
    1.1kB
     5.9kB
     15
    11
  • 172.64.165.7:443
    https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251
    tls, http2
    IEXPLORE.EXE
    2.1kB
     25.3kB
     32
    26

    HTTP Request

    GET https://ka-f.fontawesome.com/releases/v5.15.4/css/free.min.css?token=585b051251

    HTTP Request

    GET https://ka-f.fontawesome.com/releases/v5.15.4/css/free-v4-shims.min.css?token=585b051251

    HTTP Response

    200

    HTTP Response

    200
  • 104.17.24.14:443
    cdnjs.cloudflare.com
    tls, http2
    IEXPLORE.EXE
    1.0kB
     3.6kB
     13
    9
  • 104.17.24.14:443
    https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
    tls, http2
    IEXPLORE.EXE
    1.8kB
     11.8kB
     24
    19

    HTTP Request

    GET https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js

    HTTP Response

    200
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
     8.1kB
     15
    14
  • 8.8.8.8:53
    static.cloudflareinsights.com
    dns
    IEXPLORE.EXE
    75 B
     107 B
     1
    1

    DNS Request

    static.cloudflareinsights.com

    DNS Response

    104.16.56.101
    104.16.57.101

  • 8.8.8.8:53
    ajax.googleapis.com
    dns
    IEXPLORE.EXE
    65 B
     81 B
     1
    1

    DNS Request

    ajax.googleapis.com

    DNS Response

    142.250.200.10

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    101.56.16.104.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    101.56.16.104.in-addr.arpa

  • 8.8.8.8:53
    code.jquery.com
    dns
    IEXPLORE.EXE
    61 B
     125 B
     1
    1

    DNS Request

    code.jquery.com

    DNS Response

    151.101.66.137
    151.101.130.137
    151.101.194.137
    151.101.2.137

  • 8.8.8.8:53
    79.121.231.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    79.121.231.20.in-addr.arpa

  • 8.8.8.8:53
    201.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    201.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    10.200.250.142.in-addr.arpa
    dns
    73 B
     112 B
     1
    1

    DNS Request

    10.200.250.142.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    3.178.250.142.in-addr.arpa
    dns
    72 B
     110 B
     1
    1

    DNS Request

    3.178.250.142.in-addr.arpa

  • 8.8.8.8:53
    137.66.101.151.in-addr.arpa
    dns
    73 B
     133 B
     1
    1

    DNS Request

    137.66.101.151.in-addr.arpa

  • 8.8.8.8:53
    23.149.64.172.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    23.149.64.172.in-addr.arpa

  • 8.8.8.8:53
    233.38.18.104.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    233.38.18.104.in-addr.arpa

  • 8.8.8.8:53
    maxcdn.bootstrapcdn.com
    dns
    IEXPLORE.EXE
    69 B
     101 B
     1
    1

    DNS Request

    maxcdn.bootstrapcdn.com

    DNS Response

    104.18.10.207
    104.18.11.207

  • 8.8.8.8:53
    207.10.18.104.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    207.10.18.104.in-addr.arpa

  • 8.8.8.8:53
    kit.fontawesome.com
    dns
    IEXPLORE.EXE
    65 B
     149 B
     1
    1

    DNS Request

    kit.fontawesome.com

    DNS Response

    104.18.40.68
    172.64.147.188

  • 8.8.8.8:53
    ka-f.fontawesome.com
    dns
    IEXPLORE.EXE
    66 B
     151 B
     1
    1

    DNS Request

    ka-f.fontawesome.com

    DNS Response

    172.64.165.7
    172.64.164.7

  • 8.8.8.8:53
    10.180.250.142.in-addr.arpa
    dns
    73 B
     112 B
     1
    1

    DNS Request

    10.180.250.142.in-addr.arpa

  • 8.8.8.8:53
    68.40.18.104.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    68.40.18.104.in-addr.arpa

  • 8.8.8.8:53
    68.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    68.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    cdnjs.cloudflare.com
    dns
    IEXPLORE.EXE
    66 B
     98 B
     1
    1

    DNS Request

    cdnjs.cloudflare.com

    DNS Response

    104.17.24.14
    104.17.25.14

  • 8.8.8.8:53
    7.165.64.172.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    7.165.64.172.in-addr.arpa

  • 8.8.8.8:53
    14.24.17.104.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    14.24.17.104.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    161.19.199.152.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    161.19.199.152.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    140 B
     288 B
     2
    2

    DNS Request

    18.31.95.13.in-addr.arpa

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    18.134.221.88.in-addr.arpa
    dns
    144 B
     274 B
     2
    2

    DNS Request

    18.134.221.88.in-addr.arpa

    DNS Request

    18.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    192.178.17.96.in-addr.arpa
    dns
    144 B
     274 B
     2
    2

    DNS Request

    192.178.17.96.in-addr.arpa

    DNS Request

    192.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    146 B
     212 B
     2
    2

    DNS Request

    200.197.79.204.in-addr.arpa

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    144 B
     316 B
     2
    2

    DNS Request

    43.229.111.52.in-addr.arpa

    DNS Request

    43.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    7bde92ff965b73dc76190e608c2fbb93

    SHA1

    95547789d183bbf9ea20ef6ba4c6b2f0249fb30d

    SHA256

    821420f187b512f853c8b73d9439e940e6e04c499532561343a739717a9a76ee

    SHA512

    21406b04613e8be9f2036f5057d6d3de568ec1aa4eb6471cd457e70e6ddadfc3b988d5f4c2d316e548b21b2850944a78d75a44ec3bf929e71fe61fb6b0de4ec6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    404B

    MD5

    6ed2edb94609f258f3e21b30cbc7bacd

    SHA1

    c10cba39ca8558a8409f2b27b8c811ed88b75e3f

    SHA256

    6c6117e5c937f333cbaeb00f4a9e0249f0bde5fd9d4db9804a8ce063603e4dae

    SHA512

    88b3981dfeade4af83503cacc54fcf5ce7811cec34797cd721e5a4ba184bcbbab66df2fa59d541e32433a638776a878ce7226d5a19b3f91e8ac2a512ac2f08b5

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\jquery-3.1.1.min[1].js
    Filesize

    84KB

    MD5

    e071abda8fe61194711cfc2ab99fe104

    SHA1

    f647a6d37dc4ca055ced3cf64bbc1f490070acba

    SHA256

    85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

    SHA512

    53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0SGFK56Z\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BMK4G1YN\beacon.min[1].js
    Filesize

    19KB

    MD5

    dd1d068fdb5fe90b6c05a5b3940e088c

    SHA1

    0d96f9df8772633a9df4c81cf323a4ef8998ba59

    SHA256

    6153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101

    SHA512

    7aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ISEWAASI\jquery.min[1].js
    Filesize

    83KB

    MD5

    2f6b11a7e914718e0290410e85366fe9

    SHA1

    69bb69e25ca7d5ef0935317584e6153f3fd9a88c

    SHA256

    05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

    SHA512

    0d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.