d74d7f44801c561538a49f970f78673e5ffa37642265a3ef1522fe9c837804be

Analysis

max time kernel
142s
max time network
143s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 06:35 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

166c58aad8738ca10f2114b9cb5aec09_JaffaCakes118.html
Size

19KB
MD5

166c58aad8738ca10f2114b9cb5aec09
SHA1

4b85158bbdbc95164ca552bb15e960281a06d50c
SHA256

d74d7f44801c561538a49f970f78673e5ffa37642265a3ef1522fe9c837804be
SHA512

f6624a264d1a1e3787768eb2ef3722605e2f5ab131ee78498aed2ff5587ecac0578e2420e1dba902088c0eab651345ae132b6ba3abd14f0c052d34236704b989
SSDEEP

384:4/yWreWi1XLXfPCttpz4Sz0VQzuOMlzX0kMCn146p55infiQfiC:0yWqBvqTup5vC

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 8018a581b69eda01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC0D8C51-0AA9-11EF-92B8-52226696DE45} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000cfcdaa6f13a171b2b60fe3382eca035c3ca92fbd60d4c32318e9d5c238c9d6c4000000000e8000000002000020000000df57fcf473a91e5edf3eaca72dc16e8f0d0a17aca8cd01ee4d46043fd0d1e8ce20000000e187d541f6bf50736f16335feb0650ade0f5f7400b17443a2c854d994e5ef14440000000ec3312a9ff69ab03c45a8bd2cb86d70e482c2056de8bfaef2bbf840a93ae88f69f2e6ace503d6ff88fcc5462d1965bdb35572e17436dcdea679e8c3f114f40f9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000874a12ce112a0a874575410838eda73b33e2cb51a500420a62d2eadeb10788fe000000000e8000000002000020000000f93930db36d6b39432d2a9357b47b56914aa3ad79518bfce72399795e4b29ba8900000006c185ed7bfa70222cb7dbdde411673518fb71d236b80eface982be9d4f4973b17c52b04f5a613614027506ca0f23609c6f6cc800cf76588016aed8dbf994be94db715ca637c936b6a2d1aadea37f60187f519b0585ed22d4f140cc93a419e1dc1bb594e4eb7db441211b884eebcab8efc2f36bb92e742771a7f62503f3be2c77d1dde2b0f026733fe25fd5adac80e70840000000a2bee615785979d0201ff03c0c1a206dd28354b17c1a3b0a2712185dd4d031dc5350b41e7543ebb640b84ee794da73c8eca027864a3f151d5d516f0ede2bfab0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421052827"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f079fd93b69eda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE
2124	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2124	2208	iexplore.exe	28
PID 2208 wrote to memory of 2124	2208	iexplore.exe	28
PID 2208 wrote to memory of 2124	2208	iexplore.exe	28
PID 2208 wrote to memory of 2124	2208	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\166c58aad8738ca10f2114b9cb5aec09_JaffaCakes118.html
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

DNS

static.mackeeper.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

static.mackeeper.com

IN A

Response

static.mackeeper.com

IN CNAME

d211q1i6v7lwo2.cloudfront.net

d211q1i6v7lwo2.cloudfront.net

IN A

18.172.89.42

d211q1i6v7lwo2.cloudfront.net

IN A

18.172.89.69

d211q1i6v7lwo2.cloudfront.net

IN A

18.172.89.58

d211q1i6v7lwo2.cloudfront.net

IN A

18.172.89.102
GET

http://static.mackeeper.com/landings/123.1/css/style.min.css?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/css/style.min.css?mkv=1 HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/css/style.min.css?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 0be31418aaf200eda938a2f593d7dcf8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: TC3u3pjFypzLJa9TPKB-nmHB2FZ0oVf2mIqirCVkHJcSNJyZ055kNg==
GET

http://static.mackeeper.com/landings/libs/discounts/css/styles.css?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/discounts/css/styles.css?mkv=1 HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/discounts/css/styles.css?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 0be31418aaf200eda938a2f593d7dcf8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: aqQnuTC6v9z2lshlre5HRlHPcCxhG3-TJ3FJ3Lylk-cVhJvs_HoD4Q==
GET

http://static.mackeeper.com/landings/123.1/img/arrow_animation2.gif?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/img/arrow_animation2.gif?mkv=1 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/img/arrow_animation2.gif?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 0be31418aaf200eda938a2f593d7dcf8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: X4ydof5eyGJQaMEh7Rrog86rTxLMzy50Cj06AB_NJz6CsVVBcy6Tlg==
GET

http://static.mackeeper.com/landings/123.1/img/main-img.jpg

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/img/main-img.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:05 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/img/main-img.jpg
X-Cache: Miss from cloudfront
Via: 1.1 0be31418aaf200eda938a2f593d7dcf8.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: wPmpBNWnKnprohR1aLqRZ5x3yjhkicvrzSrWhp73L5sKY9YjX6jvuA==
GET

http://static.mackeeper.com/landings/libs/js/loclist.js?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/js/loclist.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/js/loclist.js?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 a8d7d3dded45c4593e4083a2053f8e08.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: H3eGIiUQTYSE-uuseS0fQN4uh5TfYdAOh9i1v9bWGcVi7_hFKdEmLw==
GET

http://static.mackeeper.com/landings/libs/Pixels/js/859.js?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/Pixels/js/859.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/Pixels/js/859.js?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 a8d7d3dded45c4593e4083a2053f8e08.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: afJJdc_Xi4cxFBrpu3aMLyjGnxaqwjuYy6tqx15reYr1g3UbCmw9_A==
GET

http://static.mackeeper.com/landings/123.1/img/arrow.png

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/img/arrow.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:05 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/img/arrow.png
X-Cache: Miss from cloudfront
Via: 1.1 a8d7d3dded45c4593e4083a2053f8e08.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: 8QDWJjw3wgUYsGtRYYOVKkd6503XfkCEC3cCykGZox0c3dO2LzsRwQ==
GET

http://static.mackeeper.com/landings/libs/reset.css?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/reset.css?mkv=1 HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/reset.css?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 90b5b9e6ae396b3004dd413245acabb2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: JtQRyBktQ5pSbaiJtZ4I4kGtOKEtCm1CHK1GkLVergT3GESA0zwHMA==
GET

http://static.mackeeper.com/landings/libs/overlay/overlay.js?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/overlay/overlay.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/overlay/overlay.js?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 90b5b9e6ae396b3004dd413245acabb2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: K7iwFZ_eomc4Spp-ZwMBvpFMTDlPPoiqMXG3uHLBLHbkyW3Pz1Nkog==
GET

http://static.mackeeper.com/landings/123.1/img/arrow_animation.gif?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/img/arrow_animation.gif?mkv=1 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/img/arrow_animation.gif?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 90b5b9e6ae396b3004dd413245acabb2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: PfSOqsa-keoHtd1MT6NdsWF852sr3naCOzgMiiGCvOIqhGWJKNXIRw==
GET

http://static.mackeeper.com/landings/libs/discounts/img/back.png

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/discounts/img/back.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:05 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/discounts/img/back.png
X-Cache: Miss from cloudfront
Via: 1.1 90b5b9e6ae396b3004dd413245acabb2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: 9viIBqOHkY2jR25BSBicV7FMp9ifuG_vIx40mtFQmxhTdHu8Qn3kgA==
GET

http://static.mackeeper.com/landings/123.1/img/sprite-icons.png

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/img/sprite-icons.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:05 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/img/sprite-icons.png
X-Cache: Miss from cloudfront
Via: 1.1 90b5b9e6ae396b3004dd413245acabb2.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: 5YGdLUdLiJEZKlcnUv-TIvlmuJT1C5SrokxgPLWmrrzn6c3d5BY-eA==
GET

http://static.mackeeper.com/landings/libs/alert/alerts.js?mkv=4

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/alert/alerts.js?mkv=4 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/alert/alerts.js?mkv=4
X-Cache: Miss from cloudfront
Via: 1.1 d4657bc6bf8da8c5da2e946f2079a11a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: j0v0ZPLv3t4_NN8kQUTD8_QdwvrgCBmsPRP3rGXsGGNYNgnz5r7beQ==
GET

http://static.mackeeper.com/landings/libs/Pixels/js/1282.js?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/Pixels/js/1282.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/Pixels/js/1282.js?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 d4657bc6bf8da8c5da2e946f2079a11a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: J-u4A4c5dwVE4v1jI5lAmlWnPF_uII1CUayaR1wElrN5GsXfCOW7oQ==
GET

http://static.mackeeper.com/landings/123.1/img/stars.png

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/img/stars.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:05 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/img/stars.png
X-Cache: Miss from cloudfront
Via: 1.1 d4657bc6bf8da8c5da2e946f2079a11a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: vwNZj7plndXkNKaRJYf7tpQ9riBK6W75C9V9sB42lczxmOcnlst0uA==
GET

http://static.mackeeper.com/landings/libs/jquery/jquery.min.js?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/jquery/jquery.min.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/jquery/jquery.min.js?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 3f691588ca081b6d917addc7d27405b4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: 4nzgyInsN-ToMXhqNSf2ZhnoMNJXdLOPK7HWKXD3wWjlXH8FF_xINA==
GET

http://static.mackeeper.com/landings/libs/Pixels/js/1604.js?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/Pixels/js/1604.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/Pixels/js/1604.js?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 3f691588ca081b6d917addc7d27405b4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: ybEFV94ThEwFlA8P-JlYdDweC5E-UsuhhDvHmS5230bjfQ0vSp2OGg==
GET

http://static.mackeeper.com/landings/123.1/img/pin.png

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/img/pin.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:05 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/img/pin.png
X-Cache: Miss from cloudfront
Via: 1.1 3f691588ca081b6d917addc7d27405b4.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: UOYxkSEcOwKL9ZWjoJfAq-pAtONRzIrf_a9diQO3Bgcf61IiMsrJsw==
GET

http://static.mackeeper.com/landings/libs/js/cookie.js?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/libs/js/cookie.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/libs/js/cookie.js?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 802b22fb82cbd19ab6347f222b45a3fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: IyICxRpHmbZjAcZ7_EgDvZtZdTLJFKCLWx26tHIKlUh4TdfCn2i_BA==
GET

http://static.mackeeper.com/landings/123.1/?mkv=1

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/?mkv=1 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:01 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/?mkv=1
X-Cache: Miss from cloudfront
Via: 1.1 802b22fb82cbd19ab6347f222b45a3fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: vXpn3am-RWPFFn5rjiKtygxBHtkWpdZVs7AzUz8h-TPr41LD3NHyLA==
GET

http://static.mackeeper.com/landings/123.1/img/sprite-ready-icon.png

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/img/sprite-ready-icon.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:05 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/img/sprite-ready-icon.png
X-Cache: Miss from cloudfront
Via: 1.1 802b22fb82cbd19ab6347f222b45a3fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: 9u7l4dG0TUtT7sj_c-uGCmvovsXtwPYfzTbEa23qTUUYB-rAvDnDXg==
GET

http://static.mackeeper.com/landings/123.1/img/steps-arrow.png

IEXPLORE.EXE

Remote address:

18.172.89.42:80

Request

GET /landings/123.1/img/steps-arrow.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: static.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Content-Type: text/html
Content-Length: 134
Connection: keep-alive
Server: awselb/2.0
Date: Sun, 05 May 2024 06:36:05 GMT
Location: https://mackeeperapp.mackeeper.com:443/landings/123.1/img/steps-arrow.png
X-Cache: Miss from cloudfront
Via: 1.1 802b22fb82cbd19ab6347f222b45a3fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: Pq3ttsL6s_EVU6cueZeREoqrxSeiR3j2PubAqemzygYyehlT-XO05w==
DNS

mackeeperapp.mackeeper.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

mackeeperapp.mackeeper.com

IN A

Response

mackeeperapp.mackeeper.com

IN A

18.232.227.54

mackeeperapp.mackeeper.com

IN A

3.93.140.88
GET

https://mackeeperapp.mackeeper.com/landings/libs/reset.css?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/reset.css?mkv=1 HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Mon, 30 Apr 2018 11:38:58 GMT
Vary: Accept-Encoding
ETag: W/"5ae70052-33d"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/123.1/css/style.min.css?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/css/style.min.css?mkv=1 HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 24 Nov 2020 10:39:52 GMT
Vary: Accept-Encoding
ETag: W/"5fbce2f8-4362"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/123.1/img/arrow.png

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/img/arrow.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive
Cookie: get_params_landings=%7B%22mkv%22%3A%221%22%7D; PHPSESSID=1gmpj2mbtc8540cs07n6m17ab3

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:05 GMT
Content-Type: image/png
Content-Length: 926
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 12 Sep 2019 08:55:00 GMT
ETag: "5d7a07e4-39e"
Expires: Tue, 04 Jun 2024 06:36:05 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
GET

https://mackeeperapp.mackeeper.com/landings/123.1/img/main-img.jpg

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/img/main-img.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive
Cookie: get_params_landings=%7B%22mkv%22%3A%221%22%7D; PHPSESSID=1gmpj2mbtc8540cs07n6m17ab3

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:05 GMT
Content-Type: image/jpeg
Content-Length: 38349
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 12 Sep 2019 08:55:00 GMT
ETag: "5d7a07e4-95cd"
Expires: Tue, 04 Jun 2024 06:36:05 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
GET

https://mackeeperapp.mackeeper.com/landings/libs/js/cookie.js?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/js/cookie.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Mon, 30 Apr 2018 11:38:58 GMT
Vary: Accept-Encoding
ETag: W/"5ae70052-270"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/libs/alert/alerts.js?mkv=4

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/alert/alerts.js?mkv=4 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 04 Oct 2018 13:30:26 GMT
Vary: Accept-Encoding
ETag: W/"5bb615f2-dbe8"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/123.1/img/sprite-ready-icon.png

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/img/sprite-ready-icon.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive
Cookie: get_params_landings=%7B%22mkv%22%3A%221%22%7D; PHPSESSID=1gmpj2mbtc8540cs07n6m17ab3

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:05 GMT
Content-Type: image/png
Content-Length: 2412
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 12 Sep 2019 08:55:00 GMT
ETag: "5d7a07e4-96c"
Expires: Tue, 04 Jun 2024 06:36:05 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
GET

https://mackeeperapp.mackeeper.com/landings/libs/jquery/jquery.min.js?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/jquery/jquery.min.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 19 Apr 2016 15:32:21 GMT
Vary: Accept-Encoding
ETag: W/"57164f85-1762a"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/libs/overlay/overlay.js?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/overlay/overlay.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 19 Apr 2016 15:32:21 GMT
Vary: Accept-Encoding
ETag: W/"57164f85-569"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/123.1/img/arrow_animation.gif?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/img/arrow_animation.gif?mkv=1 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: image/gif
Content-Length: 7944
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 12 Sep 2019 08:55:00 GMT
ETag: "5d7a07e4-1f08"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
GET

https://mackeeperapp.mackeeper.com/landings/123.1/img/stars.png

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/img/stars.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive
Cookie: get_params_landings=%7B%22mkv%22%3A%221%22%7D; PHPSESSID=1gmpj2mbtc8540cs07n6m17ab3

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:05 GMT
Content-Type: image/png
Content-Length: 1893
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 12 Sep 2019 08:55:00 GMT
ETag: "5d7a07e4-765"
Expires: Tue, 04 Jun 2024 06:36:05 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
GET

https://mackeeperapp.mackeeper.com/landings/123.1/img/sprite-icons.png

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/img/sprite-icons.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive
Cookie: get_params_landings=%7B%22mkv%22%3A%221%22%7D; PHPSESSID=1gmpj2mbtc8540cs07n6m17ab3

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:05 GMT
Content-Type: image/png
Content-Length: 6724
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 12 Sep 2019 08:55:00 GMT
ETag: "5d7a07e4-1a44"
Expires: Tue, 04 Jun 2024 06:36:05 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
GET

https://mackeeperapp.mackeeper.com/landings/libs/discounts/css/styles.css?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/discounts/css/styles.css?mkv=1 HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 24 May 2016 12:45:39 GMT
Vary: Accept-Encoding
ETag: W/"57444cf3-425"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/libs/Pixels/js/1604.js?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/Pixels/js/1604.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 19 Apr 2016 15:32:21 GMT
Vary: Accept-Encoding
ETag: W/"57164f85-189"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/libs/js/loclist.js?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/js/loclist.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 19 Apr 2016 15:32:21 GMT
Vary: Accept-Encoding
ETag: W/"57164f85-26c"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/libs/Pixels/js/1282.js?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/Pixels/js/1282.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Fri, 01 Jul 2016 11:50:23 GMT
Vary: Accept-Encoding
ETag: W/"577658ff-15c"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/123.1/img/arrow_animation2.gif?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/img/arrow_animation2.gif?mkv=1 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: image/gif
Content-Length: 7948
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 12 Sep 2019 08:55:00 GMT
ETag: "5d7a07e4-1f0c"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
GET

https://mackeeperapp.mackeeper.com/landings/libs/discounts/img/back.png

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/discounts/img/back.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive
Cookie: get_params_landings=%7B%22mkv%22%3A%221%22%7D; PHPSESSID=1gmpj2mbtc8540cs07n6m17ab3

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:05 GMT
Content-Type: image/png
Content-Length: 150912
Connection: keep-alive
Server: nginx
Last-Modified: Mon, 30 Apr 2018 11:38:58 GMT
ETag: "5ae70052-24d80"
Expires: Tue, 04 Jun 2024 06:36:05 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
DNS

ocsp.r2m03.amazontrust.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ocsp.r2m03.amazontrust.com

IN A

Response

ocsp.r2m03.amazontrust.com

IN A

18.172.96.64
DNS

ocsp.r2m03.amazontrust.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ocsp.r2m03.amazontrust.com

IN A

Response

ocsp.r2m03.amazontrust.com

IN A

18.172.96.64
DNS

ocsp.r2m03.amazontrust.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ocsp.r2m03.amazontrust.com

IN A

Response

ocsp.r2m03.amazontrust.com

IN A

18.172.96.64
DNS

ocsp.r2m03.amazontrust.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ocsp.r2m03.amazontrust.com

IN A

Response

ocsp.r2m03.amazontrust.com

IN A

18.172.96.64
DNS

ocsp.r2m03.amazontrust.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

ocsp.r2m03.amazontrust.com

IN A

Response

ocsp.r2m03.amazontrust.com

IN A

18.172.96.64
GET

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

IEXPLORE.EXE

Remote address:

18.172.96.64:80

Request

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.r2m03.amazontrust.com

Response

HTTP/1.1 200 OK

Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sun, 05 May 2024 05:42:05 GMT
Last-Modified: Sun, 05 May 2024 05:42:05 GMT
Server: ECAcc (lhd/3585)
X-Cache: Hit from cloudfront
Via: 1.1 fe934ec567d47455c5393801deca8b44.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: wKv3Z5rogqOK8dn5-5VHHVNT1AE_vhEIJ8jjGSuvQl1l7JV0tFaUJg==
Age: 3238
GET

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

IEXPLORE.EXE

Remote address:

18.172.96.64:80

Request

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.r2m03.amazontrust.com

Response

HTTP/1.1 200 OK

Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sun, 05 May 2024 05:42:05 GMT
Last-Modified: Sun, 05 May 2024 05:42:05 GMT
Server: ECAcc (lhd/3585)
X-Cache: Hit from cloudfront
Via: 1.1 4c91cb6d4a85f3aca5c056a81231821a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: x2FMd2si6UHQ5RO7njuP55Vu462qWMohSJ57TOoXw1ePkcAUBcqo-Q==
Age: 3238
GET

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

IEXPLORE.EXE

Remote address:

18.172.96.64:80

Request

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.r2m03.amazontrust.com

Response

HTTP/1.1 200 OK

Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sun, 05 May 2024 05:42:05 GMT
Last-Modified: Sun, 05 May 2024 05:42:05 GMT
Server: ECAcc (lhd/3585)
X-Cache: Hit from cloudfront
Via: 1.1 802b22fb82cbd19ab6347f222b45a3fc.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: zzWhCiQWs5N1whgD2O4CeVZQktvrjPi_wcf6nh-peR2OVyZsGIAb7Q==
Age: 3238
GET

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

IEXPLORE.EXE

Remote address:

18.172.96.64:80

Request

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.r2m03.amazontrust.com

Response

HTTP/1.1 200 OK

Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sun, 05 May 2024 05:42:05 GMT
Last-Modified: Sun, 05 May 2024 05:42:05 GMT
Server: ECAcc (lhd/3585)
X-Cache: Hit from cloudfront
Via: 1.1 39cfae1b17d4c6e5ba3b70d35a56260a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: XzpMphF3F-4_Kw6YJyFgojJ7RPipqBiU11tzwIpXdVTGSg3JttZfrQ==
Age: 3238
GET

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

IEXPLORE.EXE

Remote address:

18.172.96.64:80

Request

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.r2m03.amazontrust.com

Response

HTTP/1.1 200 OK

Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sun, 05 May 2024 05:42:05 GMT
Last-Modified: Sun, 05 May 2024 05:42:05 GMT
Server: ECAcc (lhd/3585)
X-Cache: Hit from cloudfront
Via: 1.1 3cbfd02048a85a0b852257fd20ba0714.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: v7Kh_L12FYZo6Lgf1lt_aQCoE2FRQE4LZUfZcN2FKb_i0jNjHObz0Q==
Age: 3238
GET

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

IEXPLORE.EXE

Remote address:

18.172.96.64:80

Request

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.r2m03.amazontrust.com

Response

HTTP/1.1 200 OK

Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sun, 05 May 2024 05:42:05 GMT
Last-Modified: Sun, 05 May 2024 05:42:05 GMT
Server: ECAcc (lhd/3585)
X-Cache: Hit from cloudfront
Via: 1.1 52e4244df100607af66490dfc58de112.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: Ia5Jh1EKYTYCNqMEaYgSOlowQbkbMf6qC5JF91leYwmrH4Eab-5qNw==
Age: 3238
GET

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

IEXPLORE.EXE

Remote address:

18.172.96.64:80

Request

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.r2m03.amazontrust.com

Response

HTTP/1.1 200 OK

Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=7200
Date: Sun, 05 May 2024 05:42:05 GMT
Last-Modified: Sun, 05 May 2024 05:42:05 GMT
Server: ECAcc (lhd/3585)
X-Cache: Hit from cloudfront
Via: 1.1 60c559b8bc9c5fb751043cfb74bd1656.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: v74tbV-rdB0AmzbAhRI9PRusQw4vg2Vjae76X3SrN06tD04GhFmngw==
Age: 3238
GET

https://mackeeperapp.mackeeper.com/landings/123.1/?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/?mkv=1 HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
Content-Security-Policy: default-src 'self' *.hotjar.com *.mackeeper.co *.mackeeper.com; frame-ancestors 'none'; frame-src 'self' 'unsafe-inline' *.a.disquscdn.com https://widget.trustpilot.com *.adsage.com *.adsitrx.com *.analytics.yahoo.com *.b2c.com *.bing.com *.disqus.com *.disqus.com *.doubleclick.net *.facebook.com *.facebook.net *.flowplayer.org *.fqtag.com *.google.com *.google.com.ua *.googleadservices.com *.google-analytics.com *.googleapis.com *.googletagmanager.com *.googletagservices.com *.gstatic.com *.hotjar.com *.i.ytimg.com *.images.dmca.com *.intljs.rmtag.com *.kromtech.com *.kromtech.net *.linksynergy.com *.mackeeper.co *.mackeeper.com *.mackeeperblog.disqus.com *.mpnrs.com *.msn.com *.optimizely.com *.yabidos.com *.s.yimg.com *.secure.ace-tag.advertising.com *.secure.leadback.advertising.com *.shopperapproved.com *.tagmanager.google.com *.tribalfusion.com *.twimg.com *.twitter.com ws://*.hotjar.com wss://*.hotjar.com *.www1.mpnrs.com *.youtube.com *.lporirxe.com *.surveygizmo.com *.liadm.com *.typeform.com mc.yandex.ru *.js.ad-score.com/ *.cdn.onesignal.com/ *.onesignal.com/ *.criteo.com https://www.zenaps.com/; child-src 'self' 'unsafe-inline' *.a.disquscdn.com *.adsage.com *.adsitrx.com *.analytics.yahoo.com *.b2c.com *.bing.com *.disqus.com *.doubleclick.net *.facebook.com *.facebook.net *.flowplayer.org *.fqtag.com *.google.com *.google.com.ua *.googleadservices.com *.google-analytics.com *.googleapis.com *.googletagmanager.com *.googletagservices.com *.gstatic.com *.hotjar.com *.i.ytimg.com *.images.dmca.com *.intljs.rmtag.com *.kromtech.com *.kromtech.net *.linksynergy.com *.mackeeper.co *.mackeeper.com *.mackeeperblog.disqus.com *.mpnrs.com *.msn.com *.optimizely.com *.yabidos.com *.s.yimg.com *.secure.ace-tag.advertising.com *.secure.leadback.advertising.com *.shopperapproved.com *.tagmanager.google.com *.tribalfusion.com *.twimg.com *.twitter.com ws://*.hotjar.com wss://*.hotjar.com *.www1.mpnrs.com *.youtube.com *.lporirxe.com *.lporirxe.com blob: *.cdn.onesignal.com/ *.onesignal.com/ *.liadm.com; form-action 'self' *.mackeeper.com *.facebook.com; img-src 'self' 'unsafe-inline' *.a.disquscdn.com *.adsage.com *.adsitrx.com *.analytics.yahoo.com *.b2c.com *.bing.com *.disqus.com *.doubleclick.net *.facebook.com *.facebook.net *.flowplayer.org *.fqtag.com *.google.com *.google.ad *.google.ae *.google.com.af *.google.com.ag *.google.com.ai *.google.al *.google.am *.google.co.ao *.google.com.ar *.google.as *.google.at *.google.com.au *.google.az *.google.ba *.google.com.bd *.google.be *.google.bf *.google.bg *.google.com.bh *.google.bi *.google.bj *.google.com.bn *.google.com.bo *.google.com.br *.google.bs *.google.bt *.google.co.bw *.google.by *.google.com.bz *.google.ca *.google.cd *.google.cf *.google.cg *.google.ch *.google.ci *.google.co.ck *.google.cl *.google.cm *.google.cn *.google.com.co *.google.co.cr *.google.com.cu *.google.cv *.google.com.cy *.google.cz *.google.de *.google.dj *.google.dk *.google.dm *.google.com.do *.google.dz *.google.com.ec *.google.ee *.google.com.eg *.google.es *.google.com.et *.google.fi *.google.com.fj *.google.fm *.google.fr *.google.ga *.google.ge *.google.gg *.google.com.gh *.google.com.gi *.google.gl *.google.gm *.google.gp *.google.gr *.google.com.gt *.google.gy *.google.com.hk *.google.hn *.google.hr *.google.ht *.google.hu *.google.co.id *.google.ie *.google.co.il *.google.im *.google.co.in *.google.iq *.google.is *.google.it *.google.je *.google.com.jm *.google.jo *.google.co.jp *.google.co.ke *.google.com.kh *.google.ki *.google.kg *.google.co.kr *.google.com.kw *.google.kz *.google.la *.google.com.lb *.google.li *.google.lk *.google.co.ls *.google.lt *.google.lu *.google.lv *.google.com.ly *.google.co.ma *.google.md *.google.me *.google.mg *.google.mk *.google.ml *.google.com.mm *.google.mn *.google.ms *.google.com.mt *.google.mu *.google.mv *.google.mw *.google.com.mx *.google.com.my *.google.co.mz *.google.com.na *.google.com.nf *.google.com.ng *.google.com.ni *.google.ne *.google.nl *.google.no *.google.com.np *.google.nr *.google.nu *.google.co.nz *.google.com.om *.google.com.pa *.google.com.pe *.google.com.pg *.google.com.ph *.google.com.pk *.google.pl *.google.pn *.google.com.pr *.google.ps *.google.pt *.google.com.py *.google.com.qa *.google.ro *.google.ru *.google.rw *.google.com.sa *.google.com.sb *.google.sc *.google.se *.google.com.sg *.google.sh *.google.si *.google.sk *.google.com.sl *.google.sn *.google.so *.google.sm *.google.sr *.google.st *.google.com.sv *.google.td *.google.tg *.google.co.th *.google.com.tj *.google.tk *.google.tl *.google.tm *.google.tn *.google.to *.google.com.tr *.google.tt *.google.com.tw *.google.co.tz *.google.com.ua *.google.co.ug *.google.co.uk *.google.com.uy *.google.co.uz *.google.com.vc *.google.co.ve *.google.vg *.google.co.vi *.google.com.vn *.google.vu *.google.ws *.google.rs *.google.co.za *.google.co.zm *.google.co.zw *.google.cat *.googleadservices.com *.google-analytics.com *.googleapis.com *.googletagmanager.com *.googletagservices.com *.gstatic.com *.hotjar.com *.i.ytimg.com *.images.dmca.com *.intljs.rmtag.com *.kromtech.com *.kromtech.net *.linksynergy.com *.mackeeper.co *.mackeeper.com *.mackeeperblog.disqus.com *.mpnrs.com *.msn.com *.optimizely.com *.yabidos.com *.s.yimg.com *.secure.ace-tag.advertising.com *.secure.leadback.advertising.com *.shopperapproved.com *.tagmanager.google.com *.tribalfusion.com *.twimg.com *.twitter.com ws://*.hotjar.com wss://*.hotjar.com *.www1.mpnrs.com *.youtube.com data: *.2mdn.net *.pagead2.googlesyndication.com *.glotgrx.com *.lporirxe.com *.exelator.com *.owox.com *.liadm.com *.outbrain.com *.visualwebsiteoptimizer.com *.yahoo.co.jp *.apimzb-adserver.cloudmccloud.com *.3lift.com *.surveygizmo.com *.surveygizmolibrary.s3.amazonaws.com http://mc.yandex.ru https://mc.yandex.ru cx.atdmt.com *.baidu.com/ *.gstatstrk.com *.assets.kromtech.net *.cdn.onesignal.com/ *.onesignal.com/ *.rtmark.net/ *.taboola.com *.zoomsupport.com *.cloudmccloud.com *.linkconnector.com *.linkedin.com *.linkconnector.com linkconnector.com https://www.zenaps.com https://www.awin1.com *.clarity.ms *.lfeeder.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.a.disquscdn.com widget.trustpilot.com *.adsage.com *.adsitrx.com *.analytics.yahoo.com *.b2c.com *.bing.com disqus.com *.disqus.com *.doubleclick.net *.facebook.com *.facebook.net *.flowplayer.org *.fqtag.com *.google.com *.google.com.ua *.googleadservices.com *.google-analytics.com *.googleapis.com *.googletagmanager.com *.googletagservices.com *.gstatic.com *.hotjar.com *.i.ytimg.com *.images.dmca.com *.intljs.rmtag.com *.kromtech.com *.kromtech.net *.linksynergy.com *.mackeeper.co *.mackeeper.com *.mackeeperblog.disqus.com *.mpnrs.com *.msn.com *.optimizely.com *.yabidos.com s.yimg.com *.secure.ace-tag.advertising.com *.secure.leadback.advertising.com *.shopperapproved.com *.tagmanager.google.com *.tribalfusion.com *.twimg.com *.twitter.com ws://*.hotjar.com wss://*.hotjar.com *.www1.mpnrs.com *.youtube.com l2.io *.inspectlet.com *.googlesyndication.com *.sagetrc.com *.glotgrx.com *.lporirxe.com b-code.liadm.com *.outbrain.com *.visualwebsiteoptimizer.com *.cloudfront.net/metrika/watch_ua.js *.yimg.jp http://addtocalendar.com https://addtocalendar.com *.yahoo.co.jp blob: *.surveygizmo.com *.surveygizmolibrary.s3.amazonaws.com *.s.ytimg.com *.typeform.com *.calendly.com *.linkconnector.com *.linkconnector.com mc.yandex.ru *.js.ad-score.com/ *.baidu.com/ *.cdn.onesignal.com/ *.onesignal.com/ *.rtmark.net/ *.taboola.com/ *.engine.4dsply.com *.engine.spotscenered.info *.engine.3dspk.com *.we3red.com *.engine.asadap.com *.engine.nictelroalps.com *.engine.liondigitalserving.com *.engine.addroplet.com *.beritapria.com/pixel/pixel_keeper.js cdnjs.cloudflare.com *.clickcease.com *.criteo.net *.criteo.com https://snap.licdn.com *.linkconnector.com linkconnector.com *.dwin1.com *.awin1.com *.zenaps.com https://the.sciencebehindecommerce.com *.clarity.ms *.adcell.com *.lfeeder.com; style-src 'self' 'unsafe-inline' *.doubleclick.net *.flowplayer.org *.mackeeper.co *.mackeeper.com *.twimg.com *.twitter.com *.a.disquscdn.com *.disqus.com *.googleapis.com *.fonts.gstatic.com *.mackeeperblog.disqus.com *.referrer.disqus.com *.google.com *.google.com.ua http://addtocalendar.com https://addtocalendar.com *.surveygizmo.com *.cdn.onesignal.com *.onesignal.com/ *.addtocalendar.com *.googletagmanager.com *.liadm.com; font-src 'self' data: *.doubleclick.net *.mackeeper.co *.mackeeper.com *.twimg.com *.twitter.com fonts.googleapis.com fonts.gstatic.com *.surveygizmo.com *.static.mackeeper.com; object-src *.doubleclick.net *.flowplayer.org *.mackeeper.co *.mackeeper.com *.twimg.com *.twitter.com *.pagead2.googlesyndication.com *.pagead2.googlesyndication.com *.liadm.com; connect-src 'self' *.mackeeper.co *.mackeeper.com https://mackeeper.com http://mackeeper.com https://rp.liadm.com http://rp.liadm.com *.hotjar.com ws://*.hotjar.com wss://*.hotjar.com *.g.doubleclick.net http://lcidc.liadm.com https://lcidc.liadm.com *.assets.kromtech.net *.assets.kromtech.net *.google-analytics.com *.api.ipify.org *.mc.yandex.ru mc.yandex.ru *.data.ad-score.com *.baidu.com/ *.pushdata.onesignal.com:* *.onesignal.com/ *.onesignal.com/ *.taboola.com/ *.hotjar.io *.clickcease.com s.yimg.com *.facebook.com *.google.com bat.bing.com https://idtg.account.mackeeper.com https://the.sciencebehindecommerce.com *.liadm.com *.liadm.com *.adcell.com *.clarity.ms *.lfeeder.com;
Set-Cookie: get_params_landings=%7B%22mkv%22%3A%221%22%7D; expires=Mon, 06-May-2024 06:36:03 GMT; Max-Age=86400; path=/; samesite=lax; secure
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=1gmpj2mbtc8540cs07n6m17ab3; path=/
Request-ID: 7d5bf29dc592d03d5e8cabeb7a3993ec
Content-Encoding: gzip
GET

https://mackeeperapp.mackeeper.com/landings/123.1/img/pin.png

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/img/pin.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive
Cookie: get_params_landings=%7B%22mkv%22%3A%221%22%7D; PHPSESSID=1gmpj2mbtc8540cs07n6m17ab3

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:05 GMT
Content-Type: image/png
Content-Length: 749
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 12 Sep 2019 08:55:00 GMT
ETag: "5d7a07e4-2ed"
Expires: Tue, 04 Jun 2024 06:36:05 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
GET

https://mackeeperapp.mackeeper.com/landings/123.1/img/steps-arrow.png

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/123.1/img/steps-arrow.png HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive
Cookie: get_params_landings=%7B%22mkv%22%3A%221%22%7D; PHPSESSID=1gmpj2mbtc8540cs07n6m17ab3

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:05 GMT
Content-Type: image/png
Content-Length: 434
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 12 Sep 2019 08:55:00 GMT
ETag: "5d7a07e4-1b2"
Expires: Tue, 04 Jun 2024 06:36:05 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Accept-Ranges: bytes
GET

https://mackeeperapp.mackeeper.com/landings/libs/Pixels/js/859.js?mkv=1

IEXPLORE.EXE

Remote address:

18.232.227.54:443

Request

GET /landings/libs/Pixels/js/859.js?mkv=1 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: mackeeperapp.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Sun, 05 May 2024 06:36:03 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 24 May 2016 10:01:52 GMT
Vary: Accept-Encoding
ETag: W/"57442690-1d2"
Expires: Tue, 04 Jun 2024 06:36:03 GMT
Cache-Control: max-age=2592000
Cache-Control: must-revalidate
Vary: Origin
Content-Encoding: gzip
DNS

assets.kromtech.net

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

assets.kromtech.net

IN A

Response
GET

http://fonts.googleapis.com/css?family=Open+Sans:300,600&subset=latin,latin-ext

IEXPLORE.EXE

Remote address:

216.58.204.74:80

Request

GET /css?family=Open+Sans:300,600&subset=latin,latin-ext HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: fonts.googleapis.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Expires: Sun, 05 May 2024 06:36:05 GMT
Date: Sun, 05 May 2024 06:36:05 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: cross-origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
GET

http://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600&subset=latin,latin-ext

IEXPLORE.EXE

Remote address:

216.58.204.74:80

Request

GET /css?family=Source+Sans+Pro:400,600&subset=latin,latin-ext HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: fonts.googleapis.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Expires: Sun, 05 May 2024 06:36:05 GMT
Date: Sun, 05 May 2024 06:36:05 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin-allow-popups
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
GET

http://fonts.googleapis.com/css?family=Roboto:400,600,700

IEXPLORE.EXE

Remote address:

216.58.204.74:80

Request

GET /css?family=Roboto:400,600,700 HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: fonts.googleapis.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: text/css; charset=utf-8
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
Expires: Sun, 05 May 2024 06:36:05 GMT
Date: Sun, 05 May 2024 06:36:05 GMT
Cache-Control: private, max-age=86400
Cross-Origin-Opener-Policy: same-origin-allow-popups
Cross-Origin-Resource-Policy: cross-origin
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: ESF
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
GET

http://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsiH0B4uaVQ.woff

IEXPLORE.EXE

Remote address:

216.58.212.227:80

Request

GET /s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsiH0B4uaVQ.woff HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: file:
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 31332
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 04 May 2024 20:12:50 GMT
Expires: Sun, 04 May 2025 20:12:50 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Thu, 14 Dec 2023 02:01:29 GMT
Content-Type: font/woff
Age: 37395
GET

http://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4uaVQ.woff

IEXPLORE.EXE

Remote address:

216.58.212.227:80

Request

GET /s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4uaVQ.woff HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: file:
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 31144
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 04 May 2024 13:19:49 GMT
Expires: Sun, 04 May 2025 13:19:49 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Thu, 14 Dec 2023 02:01:28 GMT
Content-Type: font/woff
Age: 62176
GET

http://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7j.woff

IEXPLORE.EXE

Remote address:

216.58.212.227:80

Request

GET /s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7j.woff HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: file:
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 36956
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 04 May 2024 08:25:47 GMT
Expires: Sun, 04 May 2025 08:25:47 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Thu, 01 Jun 2023 22:52:59 GMT
Content-Type: font/woff
Age: 79818
GET

http://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmRdo.woff

IEXPLORE.EXE

Remote address:

216.58.212.227:80

Request

GET /s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmRdo.woff HTTP/1.1
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Origin: file:
Accept-Encoding: gzip, deflate
Host: fonts.gstatic.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Access-Control-Allow-Origin: *
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="apps-themes"
Report-To: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
Timing-Allow-Origin: *
Content-Length: 36788
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Sat, 04 May 2024 17:27:26 GMT
Expires: Sun, 04 May 2025 17:27:26 GMT
Cache-Control: public, max-age=31536000
Last-Modified: Thu, 01 Jun 2023 22:52:58 GMT
Content-Type: font/woff
Age: 47319
DNS

event.mackeeper.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

event.mackeeper.com

IN A

Response

event.mackeeper.com

IN A

18.172.89.113

event.mackeeper.com

IN A

18.172.89.90

event.mackeeper.com

IN A

18.172.89.116

event.mackeeper.com

IN A

18.172.89.107
GET

https://event.mackeeper.com/event.php?step=Landing_Loaded&substep=Hit&affid=mzb_251.22132285.1515409075.28.mzb&bundleid=29_3344534&prodid=29&response=json

IEXPLORE.EXE

Remote address:

18.172.89.113:443

Request

GET /event.php?step=Landing_Loaded&substep=Hit&affid=mzb_251.22132285.1515409075.28.mzb&bundleid=29_3344534&prodid=29&response=json HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: event.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: application/json; charset=utf-8
Content-Length: 62
Connection: keep-alive
Date: Sun, 05 May 2024 06:36:06 GMT
X-Cache: Miss from cloudfront
Via: 1.1 4a1d77e109412275a22baab82ca4a7d0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: d2QLhESW1Oycya_zMpzq865moCfdMDCIXKDoRvvKoGiNNQ4hQKtBEw==
GET

https://event.mackeeper.com/event.php?step=Landing_Loaded&substep=View&affid=mzb_251.22132285.1515409075.28.mzb&bundleid=29_3344534&prodid=29&response=json

IEXPLORE.EXE

Remote address:

18.172.89.113:443

Request

GET /event.php?step=Landing_Loaded&substep=View&affid=mzb_251.22132285.1515409075.28.mzb&bundleid=29_3344534&prodid=29&response=json HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: event.mackeeper.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Content-Type: application/json; charset=utf-8
Content-Length: 62
Connection: keep-alive
Date: Sun, 05 May 2024 06:36:07 GMT
X-Cache: Miss from cloudfront
Via: 1.1 4a1d77e109412275a22baab82ca4a7d0.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: MAN51-P1
X-Amz-Cf-Id: POHK0LvaenP6oCAp9xy-A7cwnr5TYGeoE2ZXWTgLUmiOo-Tez_itnQ==
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

23.55.97.181
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

23.55.97.181

18.172.89.42:80

http://static.mackeeper.com/landings/123.1/img/main-img.jpg

http

IEXPLORE.EXE

1.9kB
3.3kB
16
10

HTTP Request

GET http://static.mackeeper.com/landings/123.1/css/style.min.css?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/libs/discounts/css/styles.css?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/img/arrow_animation2.gif?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/img/main-img.jpg

HTTP Response

301
18.172.89.42:80

http://static.mackeeper.com/landings/123.1/img/arrow.png

http

IEXPLORE.EXE

1.3kB
2.1kB
9
8

HTTP Request

GET http://static.mackeeper.com/landings/libs/js/loclist.js?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/libs/Pixels/js/859.js?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/img/arrow.png

HTTP Response

301
18.172.89.42:80

http://static.mackeeper.com/landings/123.1/img/sprite-icons.png

http

IEXPLORE.EXE

1.9kB
3.4kB
11
12

HTTP Request

GET http://static.mackeeper.com/landings/libs/reset.css?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/libs/overlay/overlay.js?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/img/arrow_animation.gif?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/libs/discounts/img/back.png

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/img/sprite-icons.png

HTTP Response

301
18.172.89.42:80

http://static.mackeeper.com/landings/123.1/img/stars.png

http

IEXPLORE.EXE

1.3kB
2.1kB
9
8

HTTP Request

GET http://static.mackeeper.com/landings/libs/alert/alerts.js?mkv=4

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/libs/Pixels/js/1282.js?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/img/stars.png

HTTP Response

301
18.172.89.42:80

http://static.mackeeper.com/landings/123.1/img/pin.png

http

IEXPLORE.EXE

1.3kB
2.1kB
9
8

HTTP Request

GET http://static.mackeeper.com/landings/libs/jquery/jquery.min.js?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/libs/Pixels/js/1604.js?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/img/pin.png

HTTP Response

301
18.172.89.42:80

http://static.mackeeper.com/landings/123.1/img/steps-arrow.png

http

IEXPLORE.EXE

1.6kB
2.7kB
10
10

HTTP Request

GET http://static.mackeeper.com/landings/libs/js/cookie.js?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/?mkv=1

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/img/sprite-ready-icon.png

HTTP Response

301

HTTP Request

GET http://static.mackeeper.com/landings/123.1/img/steps-arrow.png

HTTP Response

301
18.232.227.54:443

mackeeperapp.mackeeper.com

tls

IEXPLORE.EXE

803 B
6.0kB
10
10
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/123.1/css/style.min.css?mkv=1

tls, http

IEXPLORE.EXE

1.6kB
11.5kB
14
16

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/reset.css?mkv=1

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/css/style.min.css?mkv=1

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/123.1/img/arrow.png

tls, http

IEXPLORE.EXE

1.3kB
7.3kB
11
11

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/img/arrow.png

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/123.1/img/main-img.jpg

tls, http

IEXPLORE.EXE

1.9kB
45.9kB
25
38

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/img/main-img.jpg

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/123.1/img/sprite-ready-icon.png

tls, http

IEXPLORE.EXE

2.6kB
23.1kB
23
24

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/js/cookie.js?mkv=1

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/alert/alerts.js?mkv=4

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/img/sprite-ready-icon.png

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/libs/jquery/jquery.min.js?mkv=1

tls, http

IEXPLORE.EXE

1.8kB
41.2kB
24
36

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/jquery/jquery.min.js?mkv=1

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/123.1/img/sprite-icons.png

tls, http

IEXPLORE.EXE

3.0kB
20.0kB
22
23

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/overlay/overlay.js?mkv=1

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/img/arrow_animation.gif?mkv=1

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/img/stars.png

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/img/sprite-icons.png

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/libs/discounts/css/styles.css?mkv=1

tls, http

IEXPLORE.EXE

997 B
1.5kB
8
8

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/discounts/css/styles.css?mkv=1

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/libs/js/loclist.js?mkv=1

tls, http

IEXPLORE.EXE

1.5kB
2.3kB
10
10

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/Pixels/js/1604.js?mkv=1

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/js/loclist.js?mkv=1

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/libs/discounts/img/back.png

tls, http

IEXPLORE.EXE

4.9kB
166.5kB
74
128

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/Pixels/js/1282.js?mkv=1

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/img/arrow_animation2.gif?mkv=1

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/discounts/img/back.png

HTTP Response

200
18.172.96.64:80

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

http

IEXPLORE.EXE

762 B
1.1kB
6
4

HTTP Request

GET http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

HTTP Response

200
18.172.96.64:80

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

http

IEXPLORE.EXE

476 B
1.1kB
5
4

HTTP Request

GET http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

HTTP Response

200
18.172.96.64:80

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

http

IEXPLORE.EXE

476 B
1.1kB
5
4

HTTP Request

GET http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

HTTP Response

200
18.172.96.64:80

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

http

IEXPLORE.EXE

476 B
1.1kB
5
4

HTTP Request

GET http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

HTTP Response

200
18.172.96.64:80

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

http

IEXPLORE.EXE

476 B
1.1kB
5
4

HTTP Request

GET http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

HTTP Response

200
18.172.96.64:80

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

http

IEXPLORE.EXE

476 B
1.1kB
5
4

HTTP Request

GET http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

HTTP Response

200
18.172.96.64:80

http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

http

IEXPLORE.EXE

476 B
1.1kB
5
4

HTTP Request

GET http://ocsp.r2m03.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQqHI%2BsdmapawQncL1rpCEZZ8gTSAQUVdkYX9IczAHhWLS%2Bq9lVQgHXLgICEAz6hC7AMlmqFEXsYDF%2BXWQ%3D

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/123.1/img/steps-arrow.png

tls, http

IEXPLORE.EXE

2.7kB
26.2kB
21
28

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/?mkv=1

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/img/pin.png

HTTP Response

200

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/123.1/img/steps-arrow.png

HTTP Response

200
18.232.227.54:443

https://mackeeperapp.mackeeper.com/landings/libs/Pixels/js/859.js?mkv=1

tls, http

IEXPLORE.EXE

1.3kB
1.4kB
9
8

HTTP Request

GET https://mackeeperapp.mackeeper.com/landings/libs/Pixels/js/859.js?mkv=1

HTTP Response

200
216.58.204.74:80

http://fonts.googleapis.com/css?family=Open+Sans:300,600&subset=latin,latin-ext

http

IEXPLORE.EXE

558 B
938 B
6
5

HTTP Request

GET http://fonts.googleapis.com/css?family=Open+Sans:300,600&subset=latin,latin-ext

HTTP Response

200
216.58.204.74:80

http://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600&subset=latin,latin-ext

http

IEXPLORE.EXE

564 B
916 B
6
5

HTTP Request

GET http://fonts.googleapis.com/css?family=Source+Sans+Pro:400,600&subset=latin,latin-ext

HTTP Response

200
216.58.204.74:80

http://fonts.googleapis.com/css?family=Roboto:400,600,700

http

IEXPLORE.EXE

536 B
897 B
6
5

HTTP Request

GET http://fonts.googleapis.com/css?family=Roboto:400,600,700

HTTP Response

200
216.58.212.227:80

http://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsiH0B4uaVQ.woff

http

IEXPLORE.EXE

1.1kB
33.2kB
18
27

HTTP Request

GET http://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsiH0B4uaVQ.woff

HTTP Response

200
216.58.212.227:80

http://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4uaVQ.woff

http

IEXPLORE.EXE

1.1kB
33.0kB
18
27

HTTP Request

GET http://fonts.gstatic.com/s/opensans/v40/memSYaGs126MiZpBA-UvWbX2vVnXBbObj2OVZyOOSr4dVJWUgsgH1x4uaVQ.woff

HTTP Response

200
216.58.212.227:80

http://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7j.woff

http

IEXPLORE.EXE

1.2kB
39.0kB
20
31

HTTP Request

GET http://fonts.gstatic.com/s/sourcesanspro/v22/6xK3dSBYKcSV-LCoeQqfX1RYOo3qNq7j.woff

HTTP Response

200
216.58.212.227:80

http://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmRdo.woff

http

IEXPLORE.EXE

1.2kB
38.8kB
20
31

HTTP Request

GET http://fonts.gstatic.com/s/sourcesanspro/v22/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwmRdo.woff

HTTP Response

200
18.172.89.113:443

https://event.mackeeper.com/event.php?step=Landing_Loaded&substep=View&affid=mzb_251.22132285.1515409075.28.mzb&bundleid=29_3344534&prodid=29&response=json

tls, http

IEXPLORE.EXE

1.8kB
8.5kB
12
15

HTTP Request

GET https://event.mackeeper.com/event.php?step=Landing_Loaded&substep=Hit&affid=mzb_251.22132285.1515409075.28.mzb&bundleid=29_3344534&prodid=29&response=json

HTTP Response

200

HTTP Request

GET https://event.mackeeper.com/event.php?step=Landing_Loaded&substep=View&affid=mzb_251.22132285.1515409075.28.mzb&bundleid=29_3344534&prodid=29&response=json

HTTP Response

200
18.172.89.113:443

event.mackeeper.com

tls

IEXPLORE.EXE

698 B
6.5kB
8
11
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

799 B
7.7kB
10
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

799 B
7.7kB
10
13
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.6kB
9
12

8.8.8.8:53

static.mackeeper.com

dns

IEXPLORE.EXE

66 B
173 B
1
1

DNS Request

static.mackeeper.com

DNS Response

18.172.89.42

18.172.89.69

18.172.89.58

18.172.89.102
8.8.8.8:53

mackeeperapp.mackeeper.com

dns

IEXPLORE.EXE

72 B
104 B
1
1

DNS Request

mackeeperapp.mackeeper.com

DNS Response

18.232.227.54

3.93.140.88
8.8.8.8:53

ocsp.r2m03.amazontrust.com

dns

IEXPLORE.EXE

72 B
88 B
1
1

DNS Request

ocsp.r2m03.amazontrust.com

DNS Response

18.172.96.64
8.8.8.8:53

ocsp.r2m03.amazontrust.com

dns

IEXPLORE.EXE

72 B
88 B
1
1

DNS Request

ocsp.r2m03.amazontrust.com

DNS Response

18.172.96.64
8.8.8.8:53

ocsp.r2m03.amazontrust.com

dns

IEXPLORE.EXE

72 B
88 B
1
1

DNS Request

ocsp.r2m03.amazontrust.com

DNS Response

18.172.96.64
8.8.8.8:53

ocsp.r2m03.amazontrust.com

dns

IEXPLORE.EXE

72 B
88 B
1
1

DNS Request

ocsp.r2m03.amazontrust.com

DNS Response

18.172.96.64
8.8.8.8:53

ocsp.r2m03.amazontrust.com

dns

IEXPLORE.EXE

72 B
88 B
1
1

DNS Request

ocsp.r2m03.amazontrust.com

DNS Response

18.172.96.64
8.8.8.8:53

assets.kromtech.net

dns

IEXPLORE.EXE

65 B
146 B
1
1

DNS Request

assets.kromtech.net
8.8.8.8:53

event.mackeeper.com

dns

IEXPLORE.EXE

65 B
129 B
1
1

DNS Request

event.mackeeper.com

DNS Response

18.172.89.113

18.172.89.90

18.172.89.116

18.172.89.107
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

23.55.97.181
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

23.55.97.181

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517

Filesize
1KB

MD5
d7dc1c67787c6d490fa97dc0e3220662

SHA1
2f9a9759b6fc99811aba2925a8f2652bbacc1c6f

SHA256
390a0e37a0fece57833e381ccc098e0a2d7a77788a566860d9738b717b64b4ff

SHA512
bd3becc10cb24e216e920ae0ccc439c068a9562d84d1671f7ff9b3b7876beb4a132d7f37a8ad426893cb2a2639e3849d785cb3d9b0773f329382f8e6d767a909

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\83D863F495E7D991917B3ABB3E1EB382_4D506EBD8371D43E19D08592A41A426D

Filesize
471B

MD5
1e4425cc0ad9ea56975baf7d763ca922

SHA1
63aac326564e48e45e2494a1b545c7b85fa1ee8d

SHA256
a1b4f1aefcb94d7fc055ebe3d1a97e0a024645b506f5a5d6f98852c70fb7b32f

SHA512
7c36cc37244e7cff15da8d50d58a6cbed07738bcafb938284b9802cc97a53e2418038f220438a197974b58b31aaa7b32373275e792e939ba88c8a4fb3e650a90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
2KB

MD5
43fce733e3514c1de47be376d0473c5b

SHA1
a8492c4263e5f9a738baf5c9346f503a401f8a81

SHA256
570d7c7a22841f7d683fe8d84a0c7b2d7799c043c003f39fdd47209ed2d10c12

SHA512
c23a2e621bb552c86c27297c5cc41deba7b7df97e48b5a7441e3bd9e51db8a2cf5a5d4a3e20afa7a16e009e93fd5454774deefc6af1a2579503a8595a434f94c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
b3e591c994f7ecaa048ef05f1d5cf83e

SHA1
4cb3438bf865c08c60fd19b609e85895dfc86dde

SHA256
b98d0811117278333d9d93e2119d4f68320480600116f820f0bc4b9506acc2ce

SHA512
789c5187e9e2e8cd4f8393c6a8a61ba597fbb92d9af87b06065a77238ce0dff520d363abc23cb5d98c2f3a25b0afac50c424708ca98395907df3de59177f7256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
7858d4e708f961c5783a449286650579

SHA1
726e1db83288706c0f920597947c8a47e59eb7ec

SHA256
530d01c94841d2af8eb47e5130e63a830b498923e089bf9d165affe1f8fd1859

SHA512
1e4b812667f826da1c5679beffa46fd34d455ff9bb60895169a3476aa7b5db548bd7cbe1cf6f3c3956e4ef3d4a2f5803076d00be3992171939083f7c680ec95e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
be313763eb0a96e14e225214730ebb59

SHA1
45230799c3c58c3cb56ae2f791cefbdd56ed3a38

SHA256
37311c337f3bff2305dee54e6e7a6ebb16e75289bddebf124adf6fb24a0e865d

SHA512
0f4fd50c3d64607f1bd1d5561e7246c99d4e781759232e744d979e586a7fc1848a04850dde6eb1e6deb1bc4ef6c554b3e36baaab70076d52444c2ecbf67a4c97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
af2cd94da95a40b0cac73515454fab00

SHA1
bbf85712b37357380f5603a386cd24edd1c2bc81

SHA256
663c5d3d24551d9d5d145f6f314b6c78d2e2dfbbea48779c5ca5f66686a21265

SHA512
294d054ffad0dbe053a326ff4e59a156ad73d214e9ab2f053b8551f3fa1e2d56872df562f7cc019ca67c6d5ce8d95fbba9410e7809318bec844bc91cc7f4c943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0192718b670cdf2f9c0d28d526df1a4c

SHA1
b7f5d7999d4800d6db79e5e94ab724b6f4293ea9

SHA256
201fa346b03a12c4bfd3246b3231c4eb9f0571e1a06838b8ed0e3a96b3013722

SHA512
1f35d1cfa4e14c0ffca5f015c578f189219c5353cf36948ee314bc93b3b7a1d61d9301c51b2c2709e9c3e68905c31b342af13256a1f09eecd783105d549c8906

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ffae4c22159d9cf1a9fabab196a75114

SHA1
ecccbaf191d20ed933abb5b474113c74662329c9

SHA256
74e7e2f3d06f0876851118feee90e1a07c0b251e22b53961069a8ba3893cdbff

SHA512
b841606906eea9467df36fad3f246e48783166e767101e467f63a186752939164c6cf6f4853f55539bfe26298d60486705265fab4c90da4d683e25785e671b83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93b377d510f3bf04bb88e59ba2ae0fbd

SHA1
4a6a750771ac56eb5c25464ffc225a0df7a817a8

SHA256
9fb1b0b3584a7d5fa18971689c6b03c2bbfeaa7e36682bcb1692d0fdf8e16d56

SHA512
d70e9884a0792c2eddbe00de19ee26e3a3cc73c1f7eaab91f5e97b9e46585ea0084993ff2b603a31725d3608fa5483091ea8940a12ffb4fe7b5ffae8e0a00be0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4132a6160f1ac1cb61b9f8bbc68cdb56

SHA1
cb34ae5d3dde92f27779dd1ffbcadbc2be498dce

SHA256
53207ba66515e5c79167b56d98655d7f59d3ef72eec4d3d7ae4af6c2c84851f4

SHA512
ce2d762ae74fe9d38a2e222a77c64a1022ec6faec07f1c03fc4d96447e67e30a6dfd6892e4774083f7c415f50fb3025583f9205c2780a23e5a7e2fda8cf987ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6fa17fab45dcf7652413ed3db4036415

SHA1
6731bd5fc199b810cf3306c779abd150cc27fa04

SHA256
a2679d6163f31dd004eeff823b73c7c07bcd7b3f5a98b559471ee5524bad7f41

SHA512
6ec0b5b68c3002305649cee026639ed84b09411618cb25d61e4c74e49144eadd57739f3e850cd9a95bab701453a3e334ff42ec701e99dff6603ac090713981f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9c24df45bca3209aeb750419f0c0838c

SHA1
061584cd5d3865b6647bb72fadd74b1a6c9cf73a

SHA256
ad9cbb3c2152c85ba6558ebf96cbf20dc96c8681af5fae71d890f1e0ae747bbe

SHA512
e3a16e15bd7c1d5200b050d970e6a00b55fa23474d9252fe3d91bb436b6fd0eeb2092e1bedb08476018865257c8d7b5bf4abd3ff889c4e502cc637c8ee215724

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea1e47fc0a4650a51425139dcf7b3cbc

SHA1
caa6a8605c48215fa594b5ad1ff0caac87afeb0a

SHA256
338f70a7d203acdd43e7051e1370fcaa48f25f89d66d85f594e8998847262acc

SHA512
062e3a9f010b4f57f3beac7ac98757bdd46ff19fe1ba2744d13771248706c8292c461a5ff236cebce35e325ff7719cb5093da3cd209acc7557a8afb65ae278b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4109a8a7c616a351838c6ca822930ce1

SHA1
28c377bfb02e1588f6d846612c92a6f1c28b77df

SHA256
6cc89e3269eae63b3a99e8dc1fc2a2313c1d155ba25c8b0ddb9fdb248f376a1f

SHA512
f0649c8803eb16a0d6a14020e3feba51ec641998f239af789e3051847e9ae3e2a25989e81656d1d845a9f306f74cadb551686cf49dbe0321bd49a3e941da9ebd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7efca970231a569694efc5a7ef0ff1f8

SHA1
e428bfe34bf5d18b18eb02bfce4d26059d4cb4e8

SHA256
579bd96990d64ec435224f0a1505c4379b7d528b93f2d59fddf26930a9e2a196

SHA512
a29fc91b6728e39b37a4f0fad977ffcd4fa7620fbbf356be01b8686fc19b24aa1603509630df3463b5ea2542f6057fac54d7cd567c720810a0434dfda1b83c24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3f4df1ede6d5aa17939833f24df514bc

SHA1
52d741d0a9ccc4236946e3c3d38e0592af44cf35

SHA256
7863f8e0868b0ef480947d54949061236bac6561482fa86bea058bf83c89064f

SHA512
b6f963bcdc34ce46d0b4fd191ddc78e15cafa57c95606f487876a1b02100e5ffb6a1dbe828b48eb0f858834d2775e4643c65bc52290dd34a1f2881268e48fd2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f6cb0c08d753f15ae430529a9c5f2886

SHA1
bd7bf265696c8b0dba1b4f66be4cfaf6728d0806

SHA256
bf4e845b1992261623eaecd3559e1306d6007ae0c7451195c119a2be9e10daf5

SHA512
19cc15480aa23ef1fd74252dfa5d97028c1ca24186c9dfad14f66e6f8545b508fa25af40d732cac7f1a9213b2002c7d36eb75a05a9be3178d3475d3f8108b9a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68e265a6ea55702387a9f10fec12cc9d

SHA1
74a6e38ec025b9b8f53448ff80dd97bd5a3f3a70

SHA256
f23058c70dac4764c8a04cb9cd21a80e6c2d75669665578171e09de4942612b1

SHA512
e33a682b36d68a58523e317092df85cd0c85c1548236d8a772cea97287bc2ef7038fc1e4bc843e08e84ac707ad48ef1ef44a7f98b9992b4b513b8d9e07f6789b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
68c4d81183d40ded84ee32395e57ae6b

SHA1
6947b786b5852b82b908bc6bf7661f86a25ac83a

SHA256
15dc456946ee8e29e004ebb0e889d247e5c98d94d7bcbab8ae75e7ab744109e8

SHA512
e570d00a39cb4cc8cbec50527eff466c15fb59de63ddabc6735c97be0a97494c9f0c6933faaf49662e8b418428f8038d794464852542d1ea4802003fa738db00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fbaef3407c83f1436fbf775efe455651

SHA1
61d0ef805d41df0730070792b7f8b4103f9ade68

SHA256
42075619ea3605a7c23c01ff33f132677b956f75f55474363a32f5e10f8e9b86

SHA512
3ab48080d6967c889f19d459cdab9cb6a37044248dd129c1f8d26799699f988391ef96abd97602a6497e8fa4fe67e688b473f93a855d08cb6cfb614fd206ee18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97bbe2514a2bb17567db904aa691caba

SHA1
8c96b7b353555372e3a821c5184297415c1d7a2f

SHA256
af6df3dc8239d3e19403a6b1f8acea9450d5af66284977eb56d2c9c390780343

SHA512
2ade6c74ff3092291ee39f9dd3ee382b8b867c381512c4fcff0403a870e9dd790ba4b2266406f0e3d41efb38bf91c196fcb0760c0cad842cb5caf1218f2b6a2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a4e7ebd9ee67090e2e4ffa6346bb6689

SHA1
d15d6335c4645471c05c2b18ff336e68b738d1e3

SHA256
508db6bfb48145bc668faf502424a71a8491d4a7402a2c7f46f61c4588bf97d3

SHA512
79f78523c247a143319bd973a236d3aebec7a18ca7846da9b2944536729dcc59b717acffcd5a6d03f1de64956cf8c7b4f19598fe2b08052929e6e657b69f0b40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e02513f7ffe02cd770457205e2212705

SHA1
95a58dbfd8c559e3715c92d8a591c9cbc4fd7302

SHA256
7994f83650654028d9f67f27e2c89a0a8b32b2e315fd7e217dd74621f0173ce5

SHA512
c2cc4c7491de755ed12f7f3014f8df7dbd8cc9947562a8e95e0da43eef8006bae7f96f5689fd174cfb068738927ddc3acccc9d72b0da19b87a9315587b771f90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7e138850d7b0bd14e4ebacd3f8e70f1c

SHA1
4735f81070ba1e78708d730fd55e606751770a4d

SHA256
d39c851b98864de8a8845c9b910ba41fd439c6e1f061b0da355f8e953527de05

SHA512
17177c59d00d6bd59f0dfff0c9b8f555b0fdc59fcaeb4cd07c5a0a051947c6b5b46ca0542d8dd6db5caab7d4af7811d5c191b35126bed5fa736bc40aab62d148

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
95d73f7f371138290d94f31ae30bffbd

SHA1
0d5079c626046d933d98c05fae848d0e40799ba1

SHA256
24e5090b115c4b41058c09a6fc042e170957596e23fdfc912ccea14c1deff7e3

SHA512
5fb02c2a4d33e359fa467397a1e22695a39b3caee1c3adc9147a54b214b0080734a609de55bf3e50d20d40063218c9169ad8a3b95f550719288a1cc5c7f41ccb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ee2be65f0ccee9d7b1d1c5a556b23a97

SHA1
62ab43357239beaa30908f1664a2998c92a4edd0

SHA256
906409909a7e2e920b4a46df6f578da4efac46d8129ab2581a759bcf1a99b36b

SHA512
ebdc2ad788570a9760e3dedb050aea65214699bb0801b8451dcf71ce623d687fe0f73b3320a7e814e6ec17bbc2fd39ccd5dc538deebc2f93cca9b2907ebe510a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3770dc5bc7b3c88b5a159bb00f0afb36

SHA1
fc2897a6ad3b07299b8521862355bba5cdbfe992

SHA256
a6d79101d8f7417e609939626ef3b54cfa0e6cb4bdc8d4db33caa7912c3a7347

SHA512
d2648df8d6847f6fa451514917d06a7f15e47b5c945fccdacb44d36832c6be40fbfd8a560d036355ebfa8bda80ba69cc3b58443799cf311bd10930a839eca3c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ea2f65b3e7feccf5dce6a57555bdf264

SHA1
98ab518ea40d1755aee48108f9d508e2dfb9dd3a

SHA256
4f07b161d2b60059490ab95fbe8933ee32f690a24448efa40ec3f3df86a1fdfb

SHA512
ba6c3a84ee00a20530d94ace41e12691a788a0c663f03fa391c4a03efdc25379c1ba594953528d0cf81a56a1d533f8a4c5c2a6f6e8aabe206c6cd0cd8e57afa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
105605766c6e33cad4871dbc03784078

SHA1
3d276c23d7cc62d69936e302026c4009055d84c6

SHA256
007313e04d7e25b7943844a68794ea5a2e09eb4b9022c4676218b3bc1417d534

SHA512
94ae2a8a3cc683caa62dc9f4f65c5e399757746331b4fbd9ee222ea7711c4caca88f7d0d8f102741651809c74fcdca052494b3484ac39da897f0a46eecfead9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00606622824f06d1e9a4e00d5b3c5765

SHA1
3cc47c3b3b7c43708aa4534da6279681872125ef

SHA256
2c47e558748de3258f348d453d4588553bd20827fda17665e68eb11c2b27a9af

SHA512
2f924c62ce0633f313f3f3f67090994bccd1e930b8d6231312e0da41f9e948efae2885d00aed6ae68b737999b479d194fd2aefc42d788155d3552d66a663901e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
551da0cf5cfb144e4dce1028147a1593

SHA1
b2dfee74b110da1f6e41a5d90bb656d323b6845f

SHA256
5bc73a374f0c4970969cdb544eb83b392a9066e1bde5532b4dd0f49b9fd8d171

SHA512
84b4ded746655bcdea2a9d559b345fd12de9ae31d46a0fcb972b98a22f383cdb2bcf575925e399c2055f90bb00282ebe6e94f64349a9ec7492320f083c3691ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
6d34f0114b05ee5c43550f8317dd007b

SHA1
3bd247926f3a6299c602cb4aeccd420dd865a307

SHA256
0ce9f969095b7e641b99e3fc05660b1188c3f946f55ae361ac4c01f53b47de51

SHA512
e01b69de380892ce8fc331c3acff5c781beb18ceaea4ef9a1bde82e899fab147263eecab93592f1298515de09664a62cc14c67e3ee813cffb76db3eed5da518e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYNL6UIN\cookie[1].htm

Filesize
134B

MD5
4aa7a432bb447f094408f1bd6229c605

SHA1
1965c4952cc8c082a6307ed67061a57aab6632fa

SHA256
34ccdc351dc93dbf30a8630521968421091e3ed19c31a16e32c2eabb55c6a73a

SHA512
497ba6d8ec6bf2267fe6133a432f0e9ab12b982c06bb23e3de6e5a94d036509d2556ba822e3989d8cd7e240d9bae8096fc5be8a948e3e29fe29cab1fea1fe31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab203F.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2042.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2136.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request