Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

6e4fa43f63...8.html

windows7-x64

1

6e4fa43f63...8.html

windows10-2004-x64

1

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    24/05/2024, 11:13 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6e4fa43f630a28b35827071802d66ee6_JaffaCakes118.html

  • Size

    40KB

  • MD5

    6e4fa43f630a28b35827071802d66ee6

  • SHA1

    5d2676b0ed6b42cc5259a554ab561acecedfa9da

  • SHA256

    66086c410d5482d58baa7d8441546902cd653100cba1d099dd6a180a150bd448

  • SHA512

    acdf443ce04019e306abfc1e89f32619f17cecbc293ae64cac381bd7c38c3ed3760015edfbfa6443175f387a3b8305d99134d782a4d3dfcf57399fe4665506c2

  • SSDEEP

    768:jX6rYLmnzGX2HnZj8x1bvjArXgjlnE1UCudttwxtGs:jX6riCEIj41XArX8i1UCZxtGs

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e4fa43f630a28b35827071802d66ee6_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2936
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2900

Network

  • flag-us
    DNS
    www.google.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.google.com
    IN A
    Response
    www.google.com
    IN A
    142.250.187.196
  • flag-gb
    GET
    https://www.google.com/recaptcha/api.js?render=6LfgrK8UAAAAAOWav1wLne46LtU4Va3njoRd-vwF
    IEXPLORE.EXE
    Remote address:
    142.250.187.196:443
    Request
    GET /recaptcha/api.js?render=6LfgrK8UAAAAAOWav1wLne46LtU4Va3njoRd-vwF HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Content-Type: text/javascript; charset=utf-8
    Expires: Fri, 24 May 2024 11:13:30 GMT
    Date: Fri, 24 May 2024 11:13:30 GMT
    Cache-Control: private, max-age=300
    Cross-Origin-Resource-Policy: cross-origin
    Content-Encoding: gzip
    X-Content-Type-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    Content-Security-Policy: frame-ancestors 'self'
    X-XSS-Protection: 1; mode=block
    Server: GSE
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • flag-gb
    GET
    https://www.google.com/js/th/KDM4tbexTy7L6ViUxRbTVOhzwZZy5j5sRXjuf1Qud1k.js
    IEXPLORE.EXE
    Remote address:
    142.250.187.196:443
    Request
    GET /js/th/KDM4tbexTy7L6ViUxRbTVOhzwZZy5j5sRXjuf1Qud1k.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Encoding: gzip
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs"
    Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
    Content-Length: 24055
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Thu, 23 May 2024 04:38:06 GMT
    Expires: Fri, 23 May 2025 04:38:06 GMT
    Cache-Control: public, max-age=31536000
    Last-Modified: Tue, 14 May 2024 11:30:00 GMT
    Content-Type: text/javascript
    Vary: Accept-Encoding
    Age: 110127
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    GET
    https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfgrK8UAAAAAOWav1wLne46LtU4Va3njoRd-vwF&co=ZmlsZTo.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=invisible&cb=3wwvjpneucn0
    IEXPLORE.EXE
    Remote address:
    142.250.187.196:443
    Request
    GET /recaptcha/api2/anchor?ar=1&k=6LfgrK8UAAAAAOWav1wLne46LtU4Va3njoRd-vwF&co=ZmlsZTo.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=invisible&cb=3wwvjpneucn0 HTTP/1.1
    Accept: text/html, application/xhtml+xml, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.google.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Content-Type: text/html; charset=utf-8
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Embedder-Policy: require-corp
    Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
    Content-Security-Policy: script-src 'nonce-1uoEyAufeLysHUGVUuYNlQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
    Content-Encoding: gzip
    Date: Fri, 24 May 2024 11:13:34 GMT
    Expires: Fri, 24 May 2024 11:13:34 GMT
    Cache-Control: private, max-age=0
    X-Content-Type-Options: nosniff
    X-XSS-Protection: 1; mode=block
    Server: GSE
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • flag-us
    DNS
    www.youtube.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.youtube.com
    IN A
    Response
    www.youtube.com
    IN CNAME
    youtube-ui.l.google.com
    youtube-ui.l.google.com
    IN A
    216.58.213.14
    youtube-ui.l.google.com
    IN A
    172.217.169.14
    youtube-ui.l.google.com
    IN A
    216.58.212.206
    youtube-ui.l.google.com
    IN A
    172.217.169.46
    youtube-ui.l.google.com
    IN A
    142.250.179.238
    youtube-ui.l.google.com
    IN A
    142.250.180.14
    youtube-ui.l.google.com
    IN A
    142.250.187.206
    youtube-ui.l.google.com
    IN A
    142.250.187.238
    youtube-ui.l.google.com
    IN A
    142.250.178.14
    youtube-ui.l.google.com
    IN A
    172.217.16.238
    youtube-ui.l.google.com
    IN A
    142.250.200.14
    youtube-ui.l.google.com
    IN A
    142.250.200.46
    youtube-ui.l.google.com
    IN A
    216.58.201.110
    youtube-ui.l.google.com
    IN A
    216.58.204.78
  • flag-gb
    GET
    https://www.youtube.com/embed/_CYd-9SdEOY
    IEXPLORE.EXE
    Remote address:
    216.58.213.14:443
    Request
    GET /embed/_CYd-9SdEOY HTTP/1.1
    Accept: text/html, application/xhtml+xml, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.youtube.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Content-Type: text/html; charset=utf-8
    X-Content-Type-Options: nosniff
    Cache-Control: no-cache, no-store, max-age=0, must-revalidate
    Pragma: no-cache
    Expires: Mon, 01 Jan 1990 00:00:00 GMT
    Date: Fri, 24 May 2024 11:13:30 GMT
    Strict-Transport-Security: max-age=31536000
    Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube_main"
    Report-To: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
    Origin-Trial: AmhMBR6zCLzDDxpW+HfpP67BqwIknWnyMOXOQGfzYswFmJe+fgaI6XZgAzcxOrzNtP7hEDsOo1jdjFnVr2IdxQ4AAAB4eyJvcmlnaW4iOiJodHRwczovL3lvdXR1YmUuY29tOjQ0MyIsImZlYXR1cmUiOiJXZWJWaWV3WFJlcXVlc3RlZFdpdGhEZXByZWNhdGlvbiIsImV4cGlyeSI6MTc1ODA2NzE5OSwiaXNTdWJkb21haW4iOnRydWV9
    P3P: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
    Content-Encoding: gzip
    Server: ESF
    X-XSS-Protection: 0
    Set-Cookie: YSC=pNhdAGSnshY; Domain=.youtube.com; Path=/; Secure; HttpOnly; SameSite=none
    Set-Cookie: VISITOR_INFO1_LIVE=biDUIygefmM; Domain=.youtube.com; Expires=Wed, 20-Nov-2024 11:13:30 GMT; Path=/; Secure; HttpOnly; SameSite=none
    Set-Cookie: VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgYA%3D%3D; Domain=.youtube.com; Expires=Wed, 20-Nov-2024 11:13:30 GMT; Path=/; Secure; HttpOnly; SameSite=none
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • flag-gb
    GET
    https://www.youtube.com/s/player/bc657243/www-player.css
    IEXPLORE.EXE
    Remote address:
    216.58.213.14:443
    Request
    GET /s/player/bc657243/www-player.css HTTP/1.1
    Accept: text/css, */*
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.youtube.com
    Connection: Keep-Alive
    Cookie: YSC=pNhdAGSnshY; VISITOR_INFO1_LIVE=biDUIygefmM; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgYA%3D%3D
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Encoding: gzip
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
    Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
    Content-Length: 58675
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 22 May 2024 07:28:59 GMT
    Expires: Thu, 22 May 2025 07:28:59 GMT
    Cache-Control: public, max-age=31536000
    Last-Modified: Wed, 22 May 2024 04:17:26 GMT
    Content-Type: text/css
    Vary: Accept-Encoding, Origin
    Age: 186272
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    GET
    https://www.youtube.com/s/player/bc657243/player_ias.vflset/en_US/base.js
    IEXPLORE.EXE
    Remote address:
    216.58.213.14:443
    Request
    GET /s/player/bc657243/player_ias.vflset/en_US/base.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.youtube.com
    Connection: Keep-Alive
    Cookie: YSC=pNhdAGSnshY; VISITOR_INFO1_LIVE=biDUIygefmM; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgYA%3D%3D
    Response
    HTTP/1.1 200 OK
    Content-Encoding: gzip
    Accept-Ranges: bytes
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
    Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
    Content-Length: 819281
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 22 May 2024 07:29:02 GMT
    Expires: Thu, 22 May 2025 07:29:02 GMT
    Cache-Control: public, max-age=31536000
    Last-Modified: Wed, 22 May 2024 04:17:26 GMT
    Content-Type: text/javascript
    Vary: Accept-Encoding, Origin
    Age: 186269
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    GET
    https://www.youtube.com/s/player/bc657243/player_ias.vflset/en_US/remote.js
    IEXPLORE.EXE
    Remote address:
    216.58.213.14:443
    Request
    GET /s/player/bc657243/player_ias.vflset/en_US/remote.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.youtube.com
    Connection: Keep-Alive
    Cookie: YSC=pNhdAGSnshY; VISITOR_INFO1_LIVE=biDUIygefmM; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgYA%3D%3D
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Encoding: gzip
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
    Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
    Content-Length: 39298
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Thu, 23 May 2024 04:39:30 GMT
    Expires: Fri, 23 May 2025 04:39:30 GMT
    Cache-Control: public, max-age=31536000
    Last-Modified: Wed, 22 May 2024 04:17:26 GMT
    Content-Type: text/javascript
    Vary: Accept-Encoding, Origin
    Age: 110042
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    GET
    https://www.youtube.com/s/player/bc657243/player_ias.vflset/en_US/embed.js
    IEXPLORE.EXE
    Remote address:
    216.58.213.14:443
    Request
    GET /s/player/bc657243/player_ias.vflset/en_US/embed.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.youtube.com
    Connection: Keep-Alive
    Cookie: YSC=pNhdAGSnshY; VISITOR_INFO1_LIVE=biDUIygefmM; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgYA%3D%3D
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Encoding: gzip
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
    Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
    Content-Length: 22596
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 22 May 2024 07:29:00 GMT
    Expires: Thu, 22 May 2025 07:29:00 GMT
    Cache-Control: public, max-age=31536000
    Last-Modified: Wed, 22 May 2024 04:17:26 GMT
    Content-Type: text/javascript
    Vary: Accept-Encoding, Origin
    Age: 186273
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    GET
    https://www.youtube.com/generate_204?S7g1XQ
    IEXPLORE.EXE
    Remote address:
    216.58.213.14:443
    Request
    GET /generate_204?S7g1XQ HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.youtube.com
    Connection: Keep-Alive
    Cookie: YSC=pNhdAGSnshY; VISITOR_INFO1_LIVE=biDUIygefmM; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgYA%3D%3D
    Response
    HTTP/1.1 204 No Content
    Content-Length: 0
    Cross-Origin-Resource-Policy: cross-origin
    Date: Fri, 24 May 2024 11:13:34 GMT
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    POST
    https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
    IEXPLORE.EXE
    Remote address:
    216.58.213.14:443
    Request
    POST /youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8 HTTP/1.1
    Accept: */*
    X-Goog-Request-Time: 1716549215103
    Content-Type: application/json
    X-Goog-Visitor-Id: CgtiaURVSXlnZWZtTSja7MGyBjIKCgJHQhIEGgAgYA%3D%3D
    X-YouTube-Client-Name: 56
    X-YouTube-Client-Version: 1.20240521.01.00
    X-YouTube-Utc-Offset: 0
    X-YouTube-Ad-Signals: dt=1716549209147&flash=0&frm=2&u_tz&u_his=1&u_h=720&u_w=1280&u_ah=680&u_aw=1280&u_cd=24&bc=1&bih=-12245933&biw=-12245933&brdim=8%2C5109%2C-8%2C-8%2C1280%2C%2C1296%2C696%2C300%2C150&vis=1&wgl=true&ca_type=image
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Host: www.youtube.com
    Content-Length: 10589
    Connection: Keep-Alive
    Cache-Control: no-cache
    Cookie: YSC=pNhdAGSnshY; VISITOR_INFO1_LIVE=biDUIygefmM; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgYA%3D%3D
    Response
    HTTP/1.1 200 OK
    Content-Type: application/json; charset=UTF-8
    Vary: Origin
    Vary: X-Origin
    Vary: Referer
    Content-Encoding: gzip
    Date: Fri, 24 May 2024 11:13:37 GMT
    Server: scaffolding on HTTPServer2
    Cache-Control: private
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • flag-gb
    GET
    https://www.youtube.com/s/player/bc657243/www-embed-player.vflset/www-embed-player.js
    IEXPLORE.EXE
    Remote address:
    216.58.213.14:443
    Request
    GET /s/player/bc657243/www-embed-player.vflset/www-embed-player.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: www.youtube.com
    Connection: Keep-Alive
    Cookie: YSC=pNhdAGSnshY; VISITOR_INFO1_LIVE=biDUIygefmM; VISITOR_PRIVACY_METADATA=CgJHQhIEGgAgYA%3D%3D
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Encoding: gzip
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
    Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
    Content-Length: 115840
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 22 May 2024 07:29:00 GMT
    Expires: Thu, 22 May 2025 07:29:00 GMT
    Cache-Control: public, max-age=31536000
    Last-Modified: Wed, 22 May 2024 04:17:26 GMT
    Content-Type: text/javascript
    Vary: Accept-Encoding, Origin
    Age: 186271
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    googleads.g.doubleclick.net
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    googleads.g.doubleclick.net
    IN A
    Response
    googleads.g.doubleclick.net
    IN A
    216.58.201.98
  • flag-us
    DNS
    static.doubleclick.net
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    static.doubleclick.net
    IN A
    Response
    static.doubleclick.net
    IN A
    216.58.213.6
  • flag-gb
    GET
    https://googleads.g.doubleclick.net/pagead/id
    IEXPLORE.EXE
    Remote address:
    216.58.201.98:443
    Request
    GET /pagead/id HTTP/1.1
    Accept: */*
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Host: googleads.g.doubleclick.net
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Found
    P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
    Timing-Allow-Origin: *
    Cross-Origin-Resource-Policy: cross-origin
    Location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
    Access-Control-Allow-Credentials: true
    Date: Fri, 24 May 2024 11:13:32 GMT
    Pragma: no-cache
    Expires: Fri, 01 Jan 1990 00:00:00 GMT
    Cache-Control: no-cache, no-store, must-revalidate
    Content-Type: text/html; charset=UTF-8
    X-Content-Type-Options: nosniff
    Server: cafe
    Content-Length: 0
    X-XSS-Protection: 0
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    GET
    https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
    IEXPLORE.EXE
    Remote address:
    216.58.201.98:443
    Request
    GET /pagead/id?slf_rd=1 HTTP/1.1
    Accept: */*
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Host: googleads.g.doubleclick.net
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
    Timing-Allow-Origin: *
    Cross-Origin-Resource-Policy: cross-origin
    Access-Control-Allow-Credentials: true
    Content-Type: application/json; charset=UTF-8
    Date: Fri, 24 May 2024 11:13:32 GMT
    Pragma: no-cache
    Expires: Fri, 01 Jan 1990 00:00:00 GMT
    Cache-Control: no-cache, no-store, must-revalidate
    X-Content-Type-Options: nosniff
    Content-Disposition: attachment; filename="f.txt"
    Content-Encoding: gzip
    Server: cafe
    X-XSS-Protection: 0
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • flag-gb
    GET
    https://static.doubleclick.net/instream/ad_status.js
    IEXPLORE.EXE
    Remote address:
    216.58.213.6:443
    Request
    GET /instream/ad_status.js HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: static.doubleclick.net
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Access-Control-Allow-Origin: *
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="ads-doubleclick-media"
    Report-To: {"group":"ads-doubleclick-media","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-doubleclick-media"}]}
    Timing-Allow-Origin: *
    Content-Length: 29
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Fri, 24 May 2024 11:11:13 GMT
    Expires: Fri, 24 May 2024 11:26:13 GMT
    Cache-Control: public, max-age=900
    Age: 139
    Last-Modified: Thu, 12 Dec 2013 23:40:16 GMT
    Content-Type: text/javascript
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    jnn-pa.googleapis.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    jnn-pa.googleapis.com
    IN A
    Response
    jnn-pa.googleapis.com
    IN A
    142.250.200.10
    jnn-pa.googleapis.com
    IN A
    142.250.200.42
    jnn-pa.googleapis.com
    IN A
    216.58.201.106
    jnn-pa.googleapis.com
    IN A
    216.58.204.74
    jnn-pa.googleapis.com
    IN A
    172.217.169.10
    jnn-pa.googleapis.com
    IN A
    216.58.212.202
    jnn-pa.googleapis.com
    IN A
    172.217.169.74
    jnn-pa.googleapis.com
    IN A
    142.250.179.234
    jnn-pa.googleapis.com
    IN A
    142.250.180.10
    jnn-pa.googleapis.com
    IN A
    142.250.187.202
    jnn-pa.googleapis.com
    IN A
    142.250.187.234
    jnn-pa.googleapis.com
    IN A
    142.250.178.10
    jnn-pa.googleapis.com
    IN A
    172.217.16.234
  • flag-gb
    POST
    https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create
    IEXPLORE.EXE
    Remote address:
    142.250.200.10:443
    Request
    POST /$rpc/google.internal.waa.v1.Waa/Create HTTP/1.1
    Accept: */*
    X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
    Content-Type: application/json+protobuf
    X-User-Agent: grpc-web-javascript/0.1
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Host: jnn-pa.googleapis.com
    Content-Length: 24
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Content-Type: application/json+protobuf; charset=UTF-8
    Vary: Origin
    Vary: X-Origin
    Vary: Referer
    Content-Encoding: gzip
    Date: Fri, 24 May 2024 11:13:34 GMT
    Server: ESF
    Cache-Control: private
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • flag-gb
    POST
    https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
    IEXPLORE.EXE
    Remote address:
    142.250.200.10:443
    Request
    POST /$rpc/google.internal.waa.v1.Waa/GenerateIT HTTP/1.1
    Accept: */*
    X-Goog-Api-Key: AIzaSyDyT5W0Jh49F30Pqqtyfdf7pDLFKLJoAnw
    Content-Type: application/json+protobuf
    X-User-Agent: grpc-web-javascript/0.1
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Host: jnn-pa.googleapis.com
    Content-Length: 858
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Content-Type: application/json+protobuf; charset=UTF-8
    Vary: Origin
    Vary: X-Origin
    Vary: Referer
    Content-Encoding: gzip
    Date: Fri, 24 May 2024 11:13:35 GMT
    Server: ESF
    Cache-Control: private
    X-XSS-Protection: 0
    X-Frame-Options: SAMEORIGIN
    X-Content-Type-Options: nosniff
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • flag-us
    DNS
    i.ytimg.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    i.ytimg.com
    IN A
    Response
    i.ytimg.com
    IN A
    142.250.179.246
    i.ytimg.com
    IN A
    142.250.180.22
    i.ytimg.com
    IN A
    142.250.187.214
    i.ytimg.com
    IN A
    142.250.187.246
    i.ytimg.com
    IN A
    142.250.178.22
    i.ytimg.com
    IN A
    172.217.16.246
    i.ytimg.com
    IN A
    142.250.200.22
    i.ytimg.com
    IN A
    142.250.200.54
    i.ytimg.com
    IN A
    216.58.201.118
    i.ytimg.com
    IN A
    216.58.204.86
    i.ytimg.com
    IN A
    216.58.213.22
    i.ytimg.com
    IN A
    172.217.169.22
    i.ytimg.com
    IN A
    172.217.169.86
    i.ytimg.com
    IN A
    172.217.169.54
  • flag-gb
    GET
    https://i.ytimg.com/vi/_CYd-9SdEOY/default.jpg
    IEXPLORE.EXE
    Remote address:
    142.250.179.246:443
    Request
    GET /vi/_CYd-9SdEOY/default.jpg HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: i.ytimg.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Type: image/jpeg
    Vary: Origin
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="youtube"
    Report-To: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
    Timing-Allow-Origin: *
    Content-Length: 4844
    Date: Fri, 24 May 2024 11:13:33 GMT
    Expires: Fri, 24 May 2024 13:13:33 GMT
    Cache-Control: public, max-age=7200
    ETag: "1558015213"
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    yt3.ggpht.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    yt3.ggpht.com
    IN A
    Response
    yt3.ggpht.com
    IN CNAME
    photos-ugc.l.googleusercontent.com
    photos-ugc.l.googleusercontent.com
    IN A
    142.250.180.1
  • flag-gb
    GET
    https://yt3.ggpht.com/putFN84Tfua3n-ch2qG7KmOkA-7U_HWxUyt_xVpUu7wIFo0-Al1_xJonZ35UyV_BRKpgFFGv8SI=s68-c-k-c0x00ffffff-no-rj
    IEXPLORE.EXE
    Remote address:
    142.250.180.1:443
    Request
    GET /putFN84Tfua3n-ch2qG7KmOkA-7U_HWxUyt_xVpUu7wIFo0-Al1_xJonZ35UyV_BRKpgFFGv8SI=s68-c-k-c0x00ffffff-no-rj HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: yt3.ggpht.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Access-Control-Allow-Origin: *
    Timing-Allow-Origin: *
    Access-Control-Expose-Headers: Content-Length
    Content-Disposition: inline;filename="channels4_profile.jpg"
    X-Content-Type-Options: nosniff
    Server: fife
    Content-Length: 4130
    X-XSS-Protection: 0
    Date: Fri, 24 May 2024 10:20:53 GMT
    Expires: Sat, 25 May 2024 10:20:53 GMT
    Cache-Control: public, max-age=86400, no-transform
    Age: 3161
    ETag: "v1"
    Content-Type: image/jpeg
    Vary: Origin
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    fe0.google.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    fe0.google.com
    IN A
    Response
  • flag-us
    DNS
    www.microsoft.com
    iexplore.exe
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    2.21.17.194
  • flag-gb
    GET
    https://googleads.g.doubleclick.net/pagead/id
    IEXPLORE.EXE
    Remote address:
    216.58.201.98:443
    Request
    GET /pagead/id HTTP/1.1
    Accept: */*
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Host: googleads.g.doubleclick.net
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Found
    P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
    Timing-Allow-Origin: *
    Cross-Origin-Resource-Policy: cross-origin
    Location: https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
    Access-Control-Allow-Credentials: true
    Date: Fri, 24 May 2024 11:15:34 GMT
    Pragma: no-cache
    Expires: Fri, 01 Jan 1990 00:00:00 GMT
    Cache-Control: no-cache, no-store, must-revalidate
    Content-Type: text/html; charset=UTF-8
    X-Content-Type-Options: nosniff
    Server: cafe
    Content-Length: 0
    X-XSS-Protection: 0
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-gb
    GET
    https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
    IEXPLORE.EXE
    Remote address:
    216.58.201.98:443
    Request
    GET /pagead/id?slf_rd=1 HTTP/1.1
    Accept: */*
    Referer: https://www.youtube.com/embed/_CYd-9SdEOY
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Host: googleads.g.doubleclick.net
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    P3P: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
    Timing-Allow-Origin: *
    Cross-Origin-Resource-Policy: cross-origin
    Access-Control-Allow-Credentials: true
    Content-Type: application/json; charset=UTF-8
    Date: Fri, 24 May 2024 11:15:34 GMT
    Pragma: no-cache
    Expires: Fri, 01 Jan 1990 00:00:00 GMT
    Cache-Control: no-cache, no-store, must-revalidate
    X-Content-Type-Options: nosniff
    Content-Disposition: attachment; filename="f.txt"
    Content-Encoding: gzip
    Server: cafe
    X-XSS-Protection: 0
    Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    Transfer-Encoding: chunked
  • 142.250.187.196:443
    www.google.com
    tls
    IEXPLORE.EXE
    975 B
     4.6kB
     15
    8
  • 142.250.187.196:443
    https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfgrK8UAAAAAOWav1wLne46LtU4Va3njoRd-vwF&co=ZmlsZTo.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=invisible&cb=3wwvjpneucn0
    tls, http
    IEXPLORE.EXE
    2.7kB
     34.5kB
     27
    38

    HTTP Request

    GET https://www.google.com/recaptcha/api.js?render=6LfgrK8UAAAAAOWav1wLne46LtU4Va3njoRd-vwF

    HTTP Response

    200

    HTTP Request

    GET https://www.google.com/js/th/KDM4tbexTy7L6ViUxRbTVOhzwZZy5j5sRXjuf1Qud1k.js

    HTTP Response

    200

    HTTP Request

    GET https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfgrK8UAAAAAOWav1wLne46LtU4Va3njoRd-vwF&co=ZmlsZTo.&hl=en&v=joHA60MeME-PNviL59xVH9zs&size=invisible&cb=3wwvjpneucn0

    HTTP Response

    200
  • 216.58.213.14:443
    https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8
    tls, http
    IEXPLORE.EXE
    33.8kB
     1.0MB
     420
    771

    HTTP Request

    GET https://www.youtube.com/embed/_CYd-9SdEOY

    HTTP Response

    200

    HTTP Request

    GET https://www.youtube.com/s/player/bc657243/www-player.css

    HTTP Response

    200

    HTTP Request

    GET https://www.youtube.com/s/player/bc657243/player_ias.vflset/en_US/base.js

    HTTP Response

    200

    HTTP Request

    GET https://www.youtube.com/s/player/bc657243/player_ias.vflset/en_US/remote.js

    HTTP Response

    200

    HTTP Request

    GET https://www.youtube.com/s/player/bc657243/player_ias.vflset/en_US/embed.js

    HTTP Response

    200

    HTTP Request

    GET https://www.youtube.com/generate_204?S7g1XQ

    HTTP Response

    204

    HTTP Request

    POST https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8

    HTTP Response

    200
  • 216.58.213.14:443
    https://www.youtube.com/s/player/bc657243/www-embed-player.vflset/www-embed-player.js
    tls, http
    IEXPLORE.EXE
    3.5kB
     130.0kB
     60
    99

    HTTP Request

    GET https://www.youtube.com/s/player/bc657243/www-embed-player.vflset/www-embed-player.js

    HTTP Response

    200
  • 216.58.213.14:443
    www.youtube.com
    tls
    IEXPLORE.EXE
    565 B
     395 B
     7
    6
  • 216.58.201.98:443
    googleads.g.doubleclick.net
    tls
    IEXPLORE.EXE
    764 B
     5.0kB
     10
    10
  • 216.58.201.98:443
    https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
    tls, http
    IEXPLORE.EXE
    1.5kB
     6.9kB
     13
    15

    HTTP Request

    GET https://googleads.g.doubleclick.net/pagead/id

    HTTP Response

    302

    HTTP Request

    GET https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

    HTTP Response

    200
  • 216.58.213.6:443
    https://static.doubleclick.net/instream/ad_status.js
    tls, http
    IEXPLORE.EXE
    1.2kB
     6.6kB
     12
    11

    HTTP Request

    GET https://static.doubleclick.net/instream/ad_status.js

    HTTP Response

    200
  • 216.58.213.6:443
    static.doubleclick.net
    tls
    IEXPLORE.EXE
    759 B
     5.0kB
     10
    9
  • 142.250.200.10:443
    https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT
    tls, http
    IEXPLORE.EXE
    4.0kB
     52.0kB
     37
    47

    HTTP Request

    POST https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/Create

    HTTP Response

    200

    HTTP Request

    POST https://jnn-pa.googleapis.com/$rpc/google.internal.waa.v1.Waa/GenerateIT

    HTTP Response

    200
  • 142.250.179.246:443
    https://i.ytimg.com/vi/_CYd-9SdEOY/default.jpg
    tls, http
    IEXPLORE.EXE
    1.2kB
     11.1kB
     12
    14

    HTTP Request

    GET https://i.ytimg.com/vi/_CYd-9SdEOY/default.jpg

    HTTP Response

    200
  • 142.250.179.246:443
    i.ytimg.com
    tls
    IEXPLORE.EXE
    726 B
     5.2kB
     9
    9
  • 142.250.180.1:443
    yt3.ggpht.com
    tls
    IEXPLORE.EXE
    744 B
     9.6kB
     10
    11
  • 142.250.180.1:443
    https://yt3.ggpht.com/putFN84Tfua3n-ch2qG7KmOkA-7U_HWxUyt_xVpUu7wIFo0-Al1_xJonZ35UyV_BRKpgFFGv8SI=s68-c-k-c0x00ffffff-no-rj
    tls, http
    IEXPLORE.EXE
    1.3kB
     14.5kB
     12
    15

    HTTP Request

    GET https://yt3.ggpht.com/putFN84Tfua3n-ch2qG7KmOkA-7U_HWxUyt_xVpUu7wIFo0-Al1_xJonZ35UyV_BRKpgFFGv8SI=s68-c-k-c0x00ffffff-no-rj

    HTTP Response

    200
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    845 B
     7.7kB
     11
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    799 B
     7.7kB
     10
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    1.0kB
     7.6kB
     10
    11
  • 216.58.201.98:443
    googleads.g.doubleclick.net
    tls
    IEXPLORE.EXE
    439 B
     315 B
     4
    4
  • 216.58.201.98:443
    https://googleads.g.doubleclick.net/pagead/id?slf_rd=1
    tls, http
    IEXPLORE.EXE
    1.2kB
     2.3kB
     7
    9

    HTTP Request

    GET https://googleads.g.doubleclick.net/pagead/id

    HTTP Response

    302

    HTTP Request

    GET https://googleads.g.doubleclick.net/pagead/id?slf_rd=1

    HTTP Response

    200
  • 8.8.8.8:53
    www.google.com
    dns
    IEXPLORE.EXE
    60 B
     76 B
     1
    1

    DNS Request

    www.google.com

    DNS Response

    142.250.187.196

  • 8.8.8.8:53
    www.youtube.com
    dns
    IEXPLORE.EXE
    61 B
     319 B
     1
    1

    DNS Request

    www.youtube.com

    DNS Response

    216.58.213.14
    172.217.169.14
    216.58.212.206
    172.217.169.46
    142.250.179.238
    142.250.180.14
    142.250.187.206
    142.250.187.238
    142.250.178.14
    172.217.16.238
    142.250.200.14
    142.250.200.46
    216.58.201.110
    216.58.204.78

  • 8.8.8.8:53
    googleads.g.doubleclick.net
    dns
    IEXPLORE.EXE
    73 B
     89 B
     1
    1

    DNS Request

    googleads.g.doubleclick.net

    DNS Response

    216.58.201.98

  • 8.8.8.8:53
    static.doubleclick.net
    dns
    IEXPLORE.EXE
    68 B
     84 B
     1
    1

    DNS Request

    static.doubleclick.net

    DNS Response

    216.58.213.6

  • 8.8.8.8:53
    jnn-pa.googleapis.com
    dns
    IEXPLORE.EXE
    67 B
     275 B
     1
    1

    DNS Request

    jnn-pa.googleapis.com

    DNS Response

    142.250.200.10
    142.250.200.42
    216.58.201.106
    216.58.204.74
    172.217.169.10
    216.58.212.202
    172.217.169.74
    142.250.179.234
    142.250.180.10
    142.250.187.202
    142.250.187.234
    142.250.178.10
    172.217.16.234

  • 8.8.8.8:53
    i.ytimg.com
    dns
    IEXPLORE.EXE
    57 B
     281 B
     1
    1

    DNS Request

    i.ytimg.com

    DNS Response

    142.250.179.246
    142.250.180.22
    142.250.187.214
    142.250.187.246
    142.250.178.22
    172.217.16.246
    142.250.200.22
    142.250.200.54
    216.58.201.118
    216.58.204.86
    216.58.213.22
    172.217.169.22
    172.217.169.86
    172.217.169.54

  • 8.8.8.8:53
    yt3.ggpht.com
    dns
    IEXPLORE.EXE
    59 B
     120 B
     1
    1

    DNS Request

    yt3.ggpht.com

    DNS Response

    142.250.180.1

  • 8.8.8.8:53
    fe0.google.com
    dns
    IEXPLORE.EXE
    60 B
     110 B
     1
    1

    DNS Request

    fe0.google.com

  • 8.8.8.8:53
    www.microsoft.com
    dns
    iexplore.exe
    63 B
     230 B
     1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    2.21.17.194

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
    Filesize

    410B

    MD5

    c6c5d3f7149087a9541d6c026d179fc3

    SHA1

    7c8777ed9408c7cb2a396216cc813ce68ac38cc3

    SHA256

    bf487efcc3940b3293c37798d9cc7f428469baedffbbcba9f8942e38b5db450a

    SHA512

    35bc8abec913464848e9034c76ebee68356e34c591dc4189ac84c4ba99a7ffb1ad4b8ed4be5a6234746247f6af45d629896f6cba6c68e2ca557e204841287b7f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
    Filesize

    252B

    MD5

    37033e61d01da6b5c3e9c07653ed28d8

    SHA1

    af2fd1c89bb9d94a0b19358a2deeeb7cd444f662

    SHA256

    8d7ed620459c6b7d26a34dbcfc8393dea6baf15ff967471cde65228b2eb0c2e8

    SHA512

    e80ccadc07d773af4dfc17ba7175351df90433001ab3a679bca2b70322accd7b0be5ced05223d637412e8735ccff84fa8742fbf6381184a27e9d15f36453f39b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    34636bcdc3b0eb8a55b2992a618811f7

    SHA1

    94e4d7ac9d94b800a737de3f95d457f46e6661b8

    SHA256

    49c74787d992f14a026cd4ec87408709876642e9b6c8fb3c54c84cae8f706bfa

    SHA512

    bcd3d70edb46f95f41a51dc6f273bd6afb7951d389ac0f68634dde3726db548a80f4c35c281004ed69308cf1efde9108762a45eb4faf487cd98f4c41407ff5db

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    0b9c1ce5282a72b92eb755f983ca3ada

    SHA1

    3fd0fa170b1adef67e4f19543f7e8aa9c2d1532d

    SHA256

    798ca918a5f1723381f2ea9e1cf61275e6bb08fb21cd96df9c420b8deb788bd7

    SHA512

    ad085cd2bf15701bf87691dbec76145d8a53de19f74eb21df1fa92842ba5fe1119dca61b13900a0af2e3fb1b466bd53bd718b039f585aaad7acc373d87df220d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    24ab88ce8472c3bd611bd64f9888e78d

    SHA1

    4f3eb1818487e8926576043bcfc291f1cfdcb33f

    SHA256

    311a93f3799c39f65aa837d96c54ba8886d14fcf2d17f0881ab8485fc831c21e

    SHA512

    c5600c0f9e69076d3c18d34946ca66d9e19aef4f93901f04b021b7c804a089059aae88358a0f3c70b6f27b3971bd67055db2fd4e3d8e488493f9098bd1def974

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    4d5567b506bb31c4d2b28beed0ee5d64

    SHA1

    6e68cdc04c32d0edec25a69e7570897c5ee4d29f

    SHA256

    5f2ad833895d7c790dcb97413fddf3391145562e4c2242309385b74b7b009db5

    SHA512

    1009c1af5120c4e64601bdfa215d36ecbaeb5456fb1791da658a6bf01846c725f3f2b082c3d7f88fdda879d2dede1fd7f24e2d8815a546e194b9abd19cecbb28

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    dc749fc9fb3206211c8a53c586e3d719

    SHA1

    07ee24e8a1565cefee21b67123ad1a8958d1ce72

    SHA256

    bf6c866a205870715446f57f3397a7586370a8078db18d327da9b8ec8a95a71c

    SHA512

    1af8fa7fb5b9d4610fdf7e3695872780552beb9b0891835dcae7722c5f4999a88d4cf43695f90db750131fbb75fdc6390cbe7d5330c5f1089abfbb341e61c0e1

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    dd80cad9d11bef89de77d44cde997855

    SHA1

    8fd8461ce14aad8c298a08d4c9227e782b9c457f

    SHA256

    0c8159dc6a61cd5cbde423ea8e8a2ee186662ca3ac202960833620eefa6e7fe7

    SHA512

    7dde24301c95855608246fac5228d8440c7246060140e0b44769ca27cbb6bbde9736cb75a2e1b823cb647fc807d6fae5999a15cdb0cf5d33d05693eae3a98b91

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    0b7e29bbc921ee2fe34b8d508119563a

    SHA1

    d5c15e0af670dab5e1c3dcd6bff6dff205d9adb7

    SHA256

    ae611a06195f6134176e5f8142490c0f644c96e2c9939b7b333e795bf008c9b3

    SHA512

    f6bae10539f26279b19f793105e76b3a590b70cdff8a830b06ce24aeb49e42b45a0e773bba32be20d2cf2b85fa7ad16c9169ecd9e25b2e9f5c6c91b08c934af3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    f23258167456de17bc05fe87abdc7f6a

    SHA1

    950c320461623f62539087469899965b30d567a4

    SHA256

    ea0d42d78bfc9320481197c637e8fc6823faa4205e3f3cad489f07b163b01392

    SHA512

    0f6e0dfce364944c6e3e47aecff2e829632ab78efd79db799764ff3be7e72455447d8ad226bf3ea2a80b8576f89befecf4545d84ea0596768d4d0a484afb3628

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    195065cfd864066ff30c3ab3082ab74a

    SHA1

    dba439db6c02fc8334eaeb5b92592dfc39298c54

    SHA256

    0b841cfbcced0f6c73d3478eb9c1fd6c6a7dc9f568ead2b170b54c73f990ea09

    SHA512

    08be590092defe1e4604e2573577352d67a0c0ae3f197e1411b90605ae0d806f5885ce33d43e0f3ecdd52c9ef246b16029b435cdeacd7f2b14f091d7af418bd5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    cc2764b19738d8ef24098a0e0fab6efe

    SHA1

    fef9196525f4b7a6990cd608d7b1a9cbcf49632b

    SHA256

    e7a4eb38e26fc8a9ff68718fbfad5f1d0c5acda98e40200f7f9a488b77470e0e

    SHA512

    adcd86315fcc0386b366aec503d4575a77b4f3ed13881b2b112acbf3401fe58e3d039f24b0903c9d32f278223196e5317289d8cba87e2dbc86c1e69a77d30e8d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    bf3ce79be3d0d2d46376b15d1d9335b0

    SHA1

    79bb34e41f1bc7f6bba9d00196022f94b5ee6e2e

    SHA256

    cd4576c821f029708e034fd16eb4d578f7a80b53e9b0b65eb1df045b384c46e6

    SHA512

    833df42ef30b0081c2ff0202cb346d3dce939ae65e7fdd0e71f7a6c05cb6f286169c0c9c1edfd275e28d4bd3cb7760dac08f07496766681704a413ef4e85ceba

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    e4209da85878e572453178a637239735

    SHA1

    fb67f34141ffdab642430a129cd9fa17aaab50d4

    SHA256

    ac92942058b42542e36cfbf696f2ecbb229794e7c9a4f25c3682afe36f91de27

    SHA512

    e6b0b46cf8950662de84cb7dfb2799246e4b3b9d3bd794f5f8a7eacb2bdf12553097a1d591785dd5d97fab59d998b9db254ac9349685c4163105d8146ca549e5

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    47d3d4ec77cf622a5df9a1f24a384ddf

    SHA1

    b2606a087950b7dc8f092f569c4fe33db53123fb

    SHA256

    5ce65ad61587ef18e00a2fe783a73f11728bf5f92643166ed305184629f6c83a

    SHA512

    21a315fef584c7d6c41a8dd3db7a99820b71ad211ddb7d2fdb049f50d9b0230aeca907f195ca293618da4564076da637bc362cc0b9df1f48f667ded637a54409

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    1e82821a31680d8d4a07a740cd055633

    SHA1

    24a45bc1cda772fa6b3b8ca7acceb275b399b256

    SHA256

    0b52c6eafe075260ec785865149bf23735f28c7464030d85b07c71df35833db4

    SHA512

    cdf25a5304aeb05f986fae506bbe6d1c542b4b29a9851a09af2a46e185e99adce61ae1bd88a442e6fa3dfbb18eb20becd03710f582035ba4d306f3ca4274bdb0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
    Filesize

    242B

    MD5

    f6e7f2a660d6c94582e3b196945e1d70

    SHA1

    93a482524853da2ec43998703250166a87c297ed

    SHA256

    27647a48d7922045eabdd989b40f23d9cb8107f2e4b2c543abc32d079edf4523

    SHA512

    440eb81cec47005d3955701d34f4071296543f8439e2c31104f05b3906e15c43456db8d5763cbb89f52c69f182fe6ccfcfa15ddc21d2760f5e9a3f760bd62df6

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FF6N4J9H\www.youtube[1].xml
    Filesize

    229B

    MD5

    701ae95d6fe8d74f40fcd8e02e8c2d1a

    SHA1

    1a891c10f74178faa20d2aa078b6f6bdc9078260

    SHA256

    d5b26bce658ead116f47a496b3b4f532b83d9dcaf977c4dd51c61b200af13f94

    SHA512

    b1a468b893b3318cf84df7d54726fddf58d4d37278674d32b0f30c09287b0a56fd65b31091d8703aaf22e21e650b0f0353414ae946fb27963988ce84fc5803e0

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FF6N4J9H\www.youtube[1].xml
    Filesize

    641B

    MD5

    b395574781435f69238f804758132dad

    SHA1

    dff462a1250522d3804b92db5570fe80509be569

    SHA256

    550054e96cfd2dea6f84b476fd240f12904b5f14d62b51af7696862ab53c7ed4

    SHA512

    ff0b9ef5d7af54461740f777a6c9c56c4db6f4420cde7d287f04fa0f9a45fa3b2c56cd7285fe17c80615037fd2fcdd1b691e3662ddb75815fa1491da7a3bdc9c

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FF6N4J9H\www.youtube[1].xml
    Filesize

    990B

    MD5

    63576cc1dba9edec5c6b5cb8291fbcb2

    SHA1

    3c3012e824ff5e9b4d102800337bc90183838412

    SHA256

    08b1e38277d0c13ee3e2ce0b3b6c2e54b2625782ee418eb88a3dd7e19b927134

    SHA512

    ee3de548b051be3909f0b160972417026a949827288ee872affcc8478ca25472cecbc1900f09844b44f3a4014a03875cc0b7f0cafe8c4e3692519028e9bf78e4

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\FF6N4J9H\www.youtube[1].xml
    Filesize

    13B

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\recaptcha__en[1].js
    Filesize

    522KB

    MD5

    4668e74b2b2a58381399e91a61b6d63d

    SHA1

    89ebf54e996e46f4b1e26f6dcda93bad74fc0a1c

    SHA256

    b0e3acc54460721385d2e472dda7288382f2766a06b38d2e732d034619f9b929

    SHA512

    b2ead3410dea89b658bfb0ce67842569641cd6c29889ecfb223a83637600b82b0d2e55cec26750593359663a22896f5da91d3df9f085c204803cd646a7cabc28

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab89D8.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar89DC.tmp
    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarAEA1.tmp
    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.