Analysis

  • max time kernel
    145s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 13:44 UTC

General

  • Target

    637dc87b64f6c875e3e6f4f92f97287d_JaffaCakes118.html

  • Size

    19KB

  • MD5

    637dc87b64f6c875e3e6f4f92f97287d

  • SHA1

    7f0f083dc87423144d9409501ffbc3134575f1ec

  • SHA256

    23f19ff9857605056d77f3132c9b37977abf59113ebae1ed63f0ec12bf5b339d

  • SHA512

    5b3e6e2a5047ce0d6790349492f7a37130495347ca4f26241755eddc710c4f6720ed22ccad232713c3d895eeae43b30df4d2a7ed59f534a9764f3f46fc8b09f1

  • SSDEEP

    384:ziVKhgESDVBD8cyQ3RtOnemLEXucfIk9xhe3zVc9IT:ziWSDgcV3XbmFOIk9ejqIT

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\637dc87b64f6c875e3e6f4f92f97287d_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4700
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97d9546f8,0x7ff97d954708,0x7ff97d954718
      2⤵
        PID:4436
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
        2⤵
          PID:4152
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3212
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
          2⤵
            PID:376
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
            2⤵
              PID:2660
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
              2⤵
                PID:4944
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
                2⤵
                  PID:3568
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:960
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
                  2⤵
                    PID:4584
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
                    2⤵
                      PID:4772
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                      2⤵
                        PID:3488
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
                        2⤵
                          PID:4588
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3120770335943384993,16041842895780534397,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1896
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:4444
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:4248

                          Network

                          • flag-us
                            DNS
                            img.sedoparking.com
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            img.sedoparking.com
                            IN A
                            Response
                            img.sedoparking.com
                            IN CNAME
                            sedo.cachefly.net
                            sedo.cachefly.net
                            IN CNAME
                            vip1.g5.cachefly.net
                            vip1.g5.cachefly.net
                            IN A
                            205.234.175.175
                          • flag-us
                            DNS
                            www.google.com
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            www.google.com
                            IN A
                            Response
                            www.google.com
                            IN A
                            142.250.187.196
                          • flag-us
                            DNS
                            parking.parklogic.com
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            parking.parklogic.com
                            IN A
                            Response
                            parking.parklogic.com
                            IN A
                            67.225.218.50
                          • flag-us
                            GET
                            http://img.sedoparking.com/js/jquery-1.4.2.min.js
                            msedge.exe
                            Remote address:
                            205.234.175.175:80
                            Request
                            GET /js/jquery-1.4.2.min.js HTTP/1.1
                            Host: img.sedoparking.com
                            Connection: keep-alive
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                            DNT: 1
                            Accept: */*
                            Accept-Encoding: gzip, deflate
                            Accept-Language: en-US,en;q=0.9
                            Response
                            HTTP/1.1 200 OK
                            Date: Tue, 21 May 2024 13:44:44 GMT
                            Content-Type: application/x-javascript
                            Content-Length: 26742
                            Connection: keep-alive
                            Access-Control-Allow-Origin: *
                            Cache-Control: max-age=86400
                            Expires: Wed, 22 May 2024 13:44:44 GMT
                            X-CFHash: "0d658c3f0a7efaa05a6fcee9758231b3"
                            X-CFF: B
                            Last-Modified: Thu, 28 Jun 2018 13:09:28 GMT
                            Vary: Accept-Encoding
                            X-CF3: H
                            CF4Age: 0
                            x-cf-tsc: 1698243700
                            CF4ttl: 31536000.000
                            Content-Encoding: gzip
                            X-CF2: H
                            Accept-Ranges: bytes
                            Server: CFS 0215
                            X-CF-ReqID: c490c4d9885d7ab7fb1101cfecb37d41
                            X-CF1: 11696:fF.lon1:cf:nom:cacheN.lon1-01:M
                          • flag-us
                            GET
                            http://img.sedoparking.com/templates/brick_gfx/common/logo_white.png
                            msedge.exe
                            Remote address:
                            205.234.175.175:80
                            Request
                            GET /templates/brick_gfx/common/logo_white.png HTTP/1.1
                            Host: img.sedoparking.com
                            Connection: keep-alive
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                            DNT: 1
                            Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
                            Accept-Encoding: gzip, deflate
                            Accept-Language: en-US,en;q=0.9
                            Response
                            HTTP/1.1 200 OK
                            Date: Tue, 21 May 2024 13:44:44 GMT
                            Content-Type: image/png
                            Content-Length: 2237
                            Connection: keep-alive
                            Access-Control-Allow-Origin: *
                            Cache-Control: max-age=604800
                            Expires: Tue, 28 May 2024 13:44:44 GMT
                            X-CFHash: "39b0a05252eea66e96c606ee3a957756"
                            X-CFF: B
                            Last-Modified: Thu, 28 Jun 2018 13:09:28 GMT
                            X-CF3: M
                            CF4Age: 0
                            x-cf-tsc: 1685188529
                            CF4ttl: 31536000.000
                            X-CF2: H
                            Accept-Ranges: bytes
                            Server: CFS 0215
                            X-CF-ReqID: aafc445329e3dcde63662fc0dbb93867
                            X-CF1: 11696:fF.lon1:cf:nom:cacheN.lon1-01:M
                          • flag-us
                            GET
                            http://parking.parklogic.com/page/enhance.js?pcId=2&domain=drugmeds247.com
                            msedge.exe
                            Remote address:
                            67.225.218.50:80
                            Request
                            GET /page/enhance.js?pcId=2&domain=drugmeds247.com HTTP/1.1
                            Host: parking.parklogic.com
                            Connection: keep-alive
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                            DNT: 1
                            Accept: */*
                            Accept-Encoding: gzip, deflate
                            Accept-Language: en-US,en;q=0.9
                            Response
                            HTTP/1.1 200 OK
                            Date: Tue, 21 May 2024 13:44:44 GMT
                            Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
                            X-Powered-By: PHP/5.4.16
                            Keep-Alive: timeout=5, max=99
                            Connection: Keep-Alive
                            Transfer-Encoding: chunked
                            Content-Type: text/javascript
                          • flag-gb
                            GET
                            http://www.google.com/adsense/domains/caf.js
                            msedge.exe
                            Remote address:
                            142.250.187.196:80
                            Request
                            GET /adsense/domains/caf.js HTTP/1.1
                            Host: www.google.com
                            Connection: keep-alive
                            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
                            DNT: 1
                            Accept: */*
                            Accept-Encoding: gzip, deflate
                            Accept-Language: en-US,en;q=0.9
                            Response
                            HTTP/1.1 200 OK
                            Accept-Ranges: bytes
                            Vary: Accept-Encoding
                            Content-Type: text/javascript; charset=UTF-8
                            Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
                            Cross-Origin-Resource-Policy: cross-origin
                            Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
                            Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
                            Date: Tue, 21 May 2024 13:44:44 GMT
                            Expires: Tue, 21 May 2024 13:44:44 GMT
                            Cache-Control: private, max-age=3600
                            ETag: "12321634427774657850"
                            X-Content-Type-Options: nosniff
                            Link: <https://www.adsensecustomsearchads.com>; rel="preconnect"
                            Content-Encoding: gzip
                            Transfer-Encoding: chunked
                            Server: sffe
                            X-XSS-Protection: 0
                          • flag-us
                            DNS
                            www.adsensecustomsearchads.com
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            www.adsensecustomsearchads.com
                            IN A
                            Response
                            www.adsensecustomsearchads.com
                            IN CNAME
                            www3.l.google.com
                            www3.l.google.com
                            IN A
                            142.250.187.238
                          • flag-us
                            DNS
                            ww1.drugmeds247.com
                            msedge.exe
                            Remote address:
                            8.8.8.8:53
                            Request
                            ww1.drugmeds247.com
                            IN A
                            Response
                          • flag-us
                            DNS
                            23.159.190.20.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            23.159.190.20.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            175.175.234.205.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            175.175.234.205.in-addr.arpa
                            IN PTR
                            Response
                            175.175.234.205.in-addr.arpa
                            IN PTR
                            vip1 G-anycast1cacheflynet
                          • flag-us
                            DNS
                            196.187.250.142.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            196.187.250.142.in-addr.arpa
                            IN PTR
                            Response
                            196.187.250.142.in-addr.arpa
                            IN PTR
                            lhr25s33-in-f41e100net
                          • flag-us
                            DNS
                            50.218.225.67.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            50.218.225.67.in-addr.arpa
                            IN PTR
                            Response
                            50.218.225.67.in-addr.arpa
                            IN PTR
                            lb01 parklogiccom
                          • flag-us
                            DNS
                            238.187.250.142.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            238.187.250.142.in-addr.arpa
                            IN PTR
                            Response
                            238.187.250.142.in-addr.arpa
                            IN PTR
                            lhr25s34-in-f141e100net
                          • flag-us
                            DNS
                            196.249.167.52.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            196.249.167.52.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            79.190.18.2.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            79.190.18.2.in-addr.arpa
                            IN PTR
                            Response
                            79.190.18.2.in-addr.arpa
                            IN PTR
                            a2-18-190-79deploystaticakamaitechnologiescom
                          • flag-nl
                            GET
                            https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
                            Remote address:
                            23.62.61.129:443
                            Request
                            GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
                            host: www.bing.com
                            accept: */*
                            accept-encoding: gzip, deflate, br
                            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                            Response
                            HTTP/2.0 200
                            cache-control: public, max-age=2592000
                            content-type: image/png
                            access-control-allow-origin: *
                            access-control-allow-headers: *
                            access-control-allow-methods: GET, POST, OPTIONS
                            timing-allow-origin: *
                            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
                            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                            content-length: 1107
                            date: Tue, 21 May 2024 13:44:46 GMT
                            alt-svc: h3=":443"; ma=93600
                            x-cdn-traceid: 0.7d3d3e17.1716299086.15156fe6
                          • flag-us
                            DNS
                            129.61.62.23.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            129.61.62.23.in-addr.arpa
                            IN PTR
                            Response
                            129.61.62.23.in-addr.arpa
                            IN PTR
                            a23-62-61-129deploystaticakamaitechnologiescom
                          • flag-us
                            DNS
                            104.219.191.52.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            104.219.191.52.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            86.23.85.13.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            86.23.85.13.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            18.31.95.13.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            18.31.95.13.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            77.190.18.2.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            77.190.18.2.in-addr.arpa
                            IN PTR
                            Response
                            77.190.18.2.in-addr.arpa
                            IN PTR
                            a2-18-190-77deploystaticakamaitechnologiescom
                          • flag-us
                            DNS
                            30.243.111.52.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            30.243.111.52.in-addr.arpa
                            IN PTR
                            Response
                          • flag-us
                            DNS
                            tse1.mm.bing.net
                            Remote address:
                            8.8.8.8:53
                            Request
                            tse1.mm.bing.net
                            IN A
                            Response
                            tse1.mm.bing.net
                            IN CNAME
                            mm-mm.bing.net.trafficmanager.net
                            mm-mm.bing.net.trafficmanager.net
                            IN CNAME
                            dual-a-0001.a-msedge.net
                            dual-a-0001.a-msedge.net
                            IN A
                            204.79.197.200
                            dual-a-0001.a-msedge.net
                            IN A
                            13.107.21.200
                          • flag-us
                            GET
                            https://tse1.mm.bing.net/th?id=OADD2.10239340783938_154JBSOQL12JS43YR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                            Remote address:
                            204.79.197.200:443
                            Request
                            GET /th?id=OADD2.10239340783938_154JBSOQL12JS43YR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                            host: tse1.mm.bing.net
                            accept: */*
                            accept-encoding: gzip, deflate, br
                            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                            Response
                            HTTP/2.0 200
                            cache-control: public, max-age=2592000
                            content-length: 415458
                            content-type: image/jpeg
                            x-cache: TCP_HIT
                            access-control-allow-origin: *
                            access-control-allow-headers: *
                            access-control-allow-methods: GET, POST, OPTIONS
                            timing-allow-origin: *
                            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                            x-msedge-ref: Ref A: 5638CDC3AB3A4864BD481607F1B94383 Ref B: LON04EDGE0813 Ref C: 2024-05-21T13:46:23Z
                            date: Tue, 21 May 2024 13:46:23 GMT
                          • flag-us
                            GET
                            https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
                            Remote address:
                            204.79.197.200:443
                            Request
                            GET /th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
                            host: tse1.mm.bing.net
                            accept: */*
                            accept-encoding: gzip, deflate, br
                            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                            Response
                            HTTP/2.0 200
                            cache-control: public, max-age=2592000
                            content-length: 627437
                            content-type: image/jpeg
                            x-cache: TCP_HIT
                            access-control-allow-origin: *
                            access-control-allow-headers: *
                            access-control-allow-methods: GET, POST, OPTIONS
                            timing-allow-origin: *
                            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                            x-msedge-ref: Ref A: 0398A31B4CFE4E17913894C2680BC1A8 Ref B: LON04EDGE0813 Ref C: 2024-05-21T13:46:23Z
                            date: Tue, 21 May 2024 13:46:23 GMT
                          • flag-us
                            GET
                            https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                            Remote address:
                            204.79.197.200:443
                            Request
                            GET /th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                            host: tse1.mm.bing.net
                            accept: */*
                            accept-encoding: gzip, deflate, br
                            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                            Response
                            HTTP/2.0 200
                            cache-control: public, max-age=2592000
                            content-length: 430689
                            content-type: image/jpeg
                            x-cache: TCP_HIT
                            access-control-allow-origin: *
                            access-control-allow-headers: *
                            access-control-allow-methods: GET, POST, OPTIONS
                            timing-allow-origin: *
                            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                            x-msedge-ref: Ref A: 2E83AB9090C04C05B8A4D7222E4DF017 Ref B: LON04EDGE0813 Ref C: 2024-05-21T13:46:23Z
                            date: Tue, 21 May 2024 13:46:23 GMT
                          • flag-us
                            GET
                            https://tse1.mm.bing.net/th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                            Remote address:
                            204.79.197.200:443
                            Request
                            GET /th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
                            host: tse1.mm.bing.net
                            accept: */*
                            accept-encoding: gzip, deflate, br
                            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                            Response
                            HTTP/2.0 200
                            cache-control: public, max-age=2592000
                            content-length: 792794
                            content-type: image/jpeg
                            x-cache: TCP_HIT
                            access-control-allow-origin: *
                            access-control-allow-headers: *
                            access-control-allow-methods: GET, POST, OPTIONS
                            timing-allow-origin: *
                            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
                            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                            x-msedge-ref: Ref A: 3BC36B0DD0884958B99A91F8DB841346 Ref B: LON04EDGE0813 Ref C: 2024-05-21T13:46:23Z
                            date: Tue, 21 May 2024 13:46:23 GMT
                          • flag-us
                            DNS
                            43.58.199.20.in-addr.arpa
                            Remote address:
                            8.8.8.8:53
                            Request
                            43.58.199.20.in-addr.arpa
                            IN PTR
                            Response
                          • 205.234.175.175:80
                            http://img.sedoparking.com/templates/brick_gfx/common/logo_white.png
                            http
                            msedge.exe
                            1.6kB
                            31.5kB
                            20
                            33

                            HTTP Request

                            GET http://img.sedoparking.com/js/jquery-1.4.2.min.js

                            HTTP Response

                            200

                            HTTP Request

                            GET http://img.sedoparking.com/templates/brick_gfx/common/logo_white.png

                            HTTP Response

                            200
                          • 67.225.218.50:80
                            http://parking.parklogic.com/page/enhance.js?pcId=2&domain=drugmeds247.com
                            http
                            msedge.exe
                            623 B
                            480 B
                            6
                            5

                            HTTP Request

                            GET http://parking.parklogic.com/page/enhance.js?pcId=2&domain=drugmeds247.com

                            HTTP Response

                            200
                          • 142.250.187.196:80
                            http://www.google.com/adsense/domains/caf.js
                            http
                            msedge.exe
                            1.9kB
                            77.5kB
                            35
                            62

                            HTTP Request

                            GET http://www.google.com/adsense/domains/caf.js

                            HTTP Response

                            200
                          • 142.250.187.238:443
                            www.adsensecustomsearchads.com
                            tls, http2
                            msedge.exe
                            2.2kB
                            13.1kB
                            13
                            16
                          • 23.62.61.129:443
                            https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
                            tls, http2
                            1.4kB
                            6.3kB
                            15
                            11

                            HTTP Request

                            GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

                            HTTP Response

                            200
                          • 204.79.197.200:443
                            tse1.mm.bing.net
                            tls, http2
                            1.2kB
                            8.1kB
                            16
                            14
                          • 204.79.197.200:443
                            tse1.mm.bing.net
                            tls, http2
                            1.2kB
                            8.1kB
                            16
                            14
                          • 204.79.197.200:443
                            https://tse1.mm.bing.net/th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
                            tls, http2
                            82.3kB
                            2.4MB
                            1715
                            1712

                            HTTP Request

                            GET https://tse1.mm.bing.net/th?id=OADD2.10239340783938_154JBSOQL12JS43YR&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                            HTTP Request

                            GET https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

                            HTTP Request

                            GET https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                            HTTP Request

                            GET https://tse1.mm.bing.net/th?id=OADD2.10239340783939_14IT4JGOWRFC6CMW9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

                            HTTP Response

                            200

                            HTTP Response

                            200

                            HTTP Response

                            200

                            HTTP Response

                            200
                          • 204.79.197.200:443
                            tse1.mm.bing.net
                            tls, http2
                            1.2kB
                            8.1kB
                            16
                            14
                          • 8.8.8.8:53
                            img.sedoparking.com
                            dns
                            msedge.exe
                            65 B
                            134 B
                            1
                            1

                            DNS Request

                            img.sedoparking.com

                            DNS Response

                            205.234.175.175

                          • 8.8.8.8:53
                            www.google.com
                            dns
                            msedge.exe
                            60 B
                            76 B
                            1
                            1

                            DNS Request

                            www.google.com

                            DNS Response

                            142.250.187.196

                          • 8.8.8.8:53
                            parking.parklogic.com
                            dns
                            msedge.exe
                            67 B
                            83 B
                            1
                            1

                            DNS Request

                            parking.parklogic.com

                            DNS Response

                            67.225.218.50

                          • 8.8.8.8:53
                            www.adsensecustomsearchads.com
                            dns
                            msedge.exe
                            76 B
                            120 B
                            1
                            1

                            DNS Request

                            www.adsensecustomsearchads.com

                            DNS Response

                            142.250.187.238

                          • 8.8.8.8:53
                            ww1.drugmeds247.com
                            dns
                            msedge.exe
                            65 B
                            131 B
                            1
                            1

                            DNS Request

                            ww1.drugmeds247.com

                          • 8.8.8.8:53
                            23.159.190.20.in-addr.arpa
                            dns
                            72 B
                            158 B
                            1
                            1

                            DNS Request

                            23.159.190.20.in-addr.arpa

                          • 8.8.8.8:53
                            175.175.234.205.in-addr.arpa
                            dns
                            74 B
                            116 B
                            1
                            1

                            DNS Request

                            175.175.234.205.in-addr.arpa

                          • 8.8.8.8:53
                            196.187.250.142.in-addr.arpa
                            dns
                            74 B
                            112 B
                            1
                            1

                            DNS Request

                            196.187.250.142.in-addr.arpa

                          • 8.8.8.8:53
                            50.218.225.67.in-addr.arpa
                            dns
                            72 B
                            104 B
                            1
                            1

                            DNS Request

                            50.218.225.67.in-addr.arpa

                          • 8.8.8.8:53
                            238.187.250.142.in-addr.arpa
                            dns
                            74 B
                            113 B
                            1
                            1

                            DNS Request

                            238.187.250.142.in-addr.arpa

                          • 8.8.8.8:53
                            196.249.167.52.in-addr.arpa
                            dns
                            73 B
                            147 B
                            1
                            1

                            DNS Request

                            196.249.167.52.in-addr.arpa

                          • 8.8.8.8:53
                            79.190.18.2.in-addr.arpa
                            dns
                            70 B
                            133 B
                            1
                            1

                            DNS Request

                            79.190.18.2.in-addr.arpa

                          • 224.0.0.251:5353
                            457 B
                            7
                          • 8.8.8.8:53
                            129.61.62.23.in-addr.arpa
                            dns
                            71 B
                            135 B
                            1
                            1

                            DNS Request

                            129.61.62.23.in-addr.arpa

                          • 8.8.8.8:53
                            104.219.191.52.in-addr.arpa
                            dns
                            73 B
                            147 B
                            1
                            1

                            DNS Request

                            104.219.191.52.in-addr.arpa

                          • 8.8.8.8:53
                            86.23.85.13.in-addr.arpa
                            dns
                            70 B
                            144 B
                            1
                            1

                            DNS Request

                            86.23.85.13.in-addr.arpa

                          • 8.8.8.8:53
                            18.31.95.13.in-addr.arpa
                            dns
                            70 B
                            144 B
                            1
                            1

                            DNS Request

                            18.31.95.13.in-addr.arpa

                          • 8.8.8.8:53
                            77.190.18.2.in-addr.arpa
                            dns
                            70 B
                            133 B
                            1
                            1

                            DNS Request

                            77.190.18.2.in-addr.arpa

                          • 8.8.8.8:53
                            30.243.111.52.in-addr.arpa
                            dns
                            72 B
                            158 B
                            1
                            1

                            DNS Request

                            30.243.111.52.in-addr.arpa

                          • 8.8.8.8:53
                            tse1.mm.bing.net
                            dns
                            62 B
                            173 B
                            1
                            1

                            DNS Request

                            tse1.mm.bing.net

                            DNS Response

                            204.79.197.200
                            13.107.21.200

                          • 8.8.8.8:53
                            43.58.199.20.in-addr.arpa
                            dns
                            71 B
                            157 B
                            1
                            1

                            DNS Request

                            43.58.199.20.in-addr.arpa

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            a8e767fd33edd97d306efb6905f93252

                            SHA1

                            a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

                            SHA256

                            c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

                            SHA512

                            07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                            Filesize

                            152B

                            MD5

                            439b5e04ca18c7fb02cf406e6eb24167

                            SHA1

                            e0c5bb6216903934726e3570b7d63295b9d28987

                            SHA256

                            247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

                            SHA512

                            d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            46db6bdd354a3397ad575b62b7f66066

                            SHA1

                            c6fa9953d8212e266141bd455f0670f59b07bcb4

                            SHA256

                            514ae49875664c1673427a7b3b572071130ca34b2cc4faf26942347160c254cc

                            SHA512

                            2719c4ae673f153bb77a1a2375666c502f663eb765d49918bf6cdc762e734fcfd2b2982091f9a7a41b1e4b8d88b8235387ddcb3ce17bacbf45a7075b5e53c197

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            f0e16931bcedc7bb768a75b3b2620bf9

                            SHA1

                            06bdcca9cbce3cf1950df643374e7dad5018d83a

                            SHA256

                            19147290063be9598162950259bf0de1b3a09fec3bcb59ef266c2e93ce139dd8

                            SHA512

                            201eb471a59fbe6bc455a6e3436dd364b568e2a8409cdc5d9a5897a8b9eee1f25b5e066530d67f640e08c458ef0ca4e44629de03750e3294baa2f23f61f53106

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            6752a1d65b201c13b62ea44016eb221f

                            SHA1

                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                            SHA256

                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                            SHA512

                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                            Filesize

                            11KB

                            MD5

                            6abc9f3dc9ba3408a404a37d51381dfc

                            SHA1

                            eff64d282f45b3e3a66f05c327fc87f4e2e1a35c

                            SHA256

                            552fd32a0508fd7e32cf2e3d302b8da4c76e7b8b57d9850f4eef8280a5e0cec5

                            SHA512

                            cf6becb1fd4d60b18f5ab5296c4547357cd42f23a77c41045ccfacce406f8bbc93d810b67cdf6125c25c859b1440c7c36bef8201e9a3da0f4d376e44cca2e950

                          We care about your privacy.

                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.