Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

8d7391191a...8.html

windows7-x64

1

8d7391191a...8.html

windows10-2004-x64

1

Analysis

  • max time kernel
    146s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02/06/2024, 08:25 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8d7391191a882577db4a0e9e515aebdb_JaffaCakes118.html

  • Size

    693KB

  • MD5

    8d7391191a882577db4a0e9e515aebdb

  • SHA1

    6272a44086101fabbcbc594e2b10526e8955ab8b

  • SHA256

    63b23011e6963b6942080bf2526cb6c58f8d467b1a5e69d032d34d6df673fa1d

  • SHA512

    874568321a2812c45c040eb6e6aad27bfdb320f4448d7e8a52307b035ddbf245f5b6cbfcb715bf677349356b8bfad7ed59956341c06b5bc38923dda6b3f2f157

  • SSDEEP

    12288:X5d+X3R8mU9jFv5d+X3R8mU9jFW5d+X3R8mU9jFB5d+X3R8mU9jF3:n+Wt9Bf+Wt9BU+Wt9Bd+Wt9B3

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8d7391191a882577db4a0e9e515aebdb_JaffaCakes118.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1624 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2932

Network

  • flag-us
    DNS
    api.map.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    api.map.baidu.com
    IN A
    Response
    api.map.baidu.com
    IN CNAME
    api.map.n.shifen.com
    api.map.n.shifen.com
    IN A
    103.235.46.245
  • flag-us
    DNS
    img.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    img.baidu.com
    IN A
    Response
    img.baidu.com
    IN CNAME
    static.n.shifen.com
    static.n.shifen.com
    IN A
    182.61.200.83
  • flag-hk
    GET
    http://api.map.baidu.com/images/blank.gif?t=66734452&code=5000&v=1.1
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /images/blank.gif?t=66734452&code=5000&v=1.1 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Length: 49
    Content-Type: image/gif
    Date: Sun, 02 Jun 2024 08:25:54 GMT
    Etag: "662b1993-31"
    Expires: Mon, 03 Jun 2024 08:25:54 GMT
    Http_x_bd_logid: 1554805020
    Http_x_bd_logid64: 1554805762520851466
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Last-Modified: Fri, 26 Apr 2024 03:03:47 GMT
    Server: apache
  • flag-hk
    GET
    http://api.map.baidu.com/images/openhand.cur
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /images/openhand.cur HTTP/1.1
    Accept: */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Length: 326
    Content-Type: application/octet-stream
    Date: Sun, 02 Jun 2024 08:25:55 GMT
    Etag: "662b1999-146"
    Expires: Mon, 03 Jun 2024 08:25:55 GMT
    Http_x_bd_logid: 1555186157
    Http_x_bd_logid64: 1555186410373302282
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Last-Modified: Fri, 26 Apr 2024 03:03:53 GMT
    Server: apache
  • flag-hk
    GET
    http://api.map.baidu.com/images/bg.png
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /images/bg.png HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Length: 569
    Content-Type: image/png
    Date: Sun, 02 Jun 2024 08:25:55 GMT
    Etag: "660a3836-239"
    Expires: Mon, 03 Jun 2024 08:25:55 GMT
    Http_x_bd_logid: 1555499694
    Http_x_bd_logid64: 1555499571270189322
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Last-Modified: Mon, 01 Apr 2024 04:29:42 GMT
    Server: apache
  • flag-hk
    GET
    http://api.map.baidu.com/api?key=&v=1.1&services=true
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /api?key=&v=1.1&services=true HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Length: 317
    Content-Type: text/javascript;charset=utf-8
    Date: Sun, 02 Jun 2024 08:25:46 GMT
    Expires: Mon, 03 Jun 2024 08:25:46 GMT
    Http_x_bd_logid: 1546989153
    Http_x_bd_logid64: 1546989042342598666
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    P3p: CP=" OTI DSP COR IVA OUR IND COM "
    P3p: CP=" OTI DSP COR IVA OUR IND COM "
    Server: apache
    Set-Cookie: BAIDUID=CE49783B60E11AFB63419FD01E42413A:FG=1; expires=Mon, 02-Jun-25 08:25:46 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1
    Set-Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1; expires=Mon, 02-Jun-25 08:25:46 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1
    Tracecode: 15469891530915486730060216
  • flag-hk
    GET
    http://api.map.baidu.com/getscript?v=1.1&ak=&services=true&t=20130716024058
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /getscript?v=1.1&ak=&services=true&t=20130716024058 HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Encoding: gzip
    Content-Type: text/javascript;charset=utf-8
    Date: Sun, 02 Jun 2024 08:25:47 GMT
    Expires: Mon, 03 Jun 2024 08:25:47 GMT
    Http_x_bd_logid: 1547372840
    Http_x_bd_logid64: 1547372250394517770
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Server: apache
    Tracecode: 15473728402896050186060216
    Vary: Accept-Encoding
    Transfer-Encoding: chunked
  • flag-hk
    GET
    http://api.map.baidu.com/res/11/bmap.css
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /res/11/bmap.css HTTP/1.1
    Accept: text/css, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Encoding: gzip
    Content-Type: text/css
    Date: Sun, 02 Jun 2024 08:25:54 GMT
    Etag: W/"661d44a5-2070"
    Expires: Mon, 03 Jun 2024 08:25:54 GMT
    Http_x_bd_logid: 1554777078
    Http_x_bd_logid64: 1554777842957263114
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Last-Modified: Mon, 15 Apr 2024 15:15:49 GMT
    Server: apache
    Vary: Accept-Encoding
    Transfer-Encoding: chunked
  • flag-hk
    GET
    http://api.map.baidu.com/images/copyright_logo.png
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /images/copyright_logo.png HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Length: 2586
    Content-Type: image/png
    Date: Sun, 02 Jun 2024 08:25:55 GMT
    Etag: "662b1994-a1a"
    Expires: Mon, 03 Jun 2024 08:25:55 GMT
    Http_x_bd_logid: 1555220432
    Http_x_bd_logid64: 1555220750188883978
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Last-Modified: Fri, 26 Apr 2024 03:03:48 GMT
    Server: apache
  • flag-hk
    GET
    http://api.map.baidu.com/images/blank.gif
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /images/blank.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Length: 49
    Content-Type: image/gif
    Date: Sun, 02 Jun 2024 08:25:56 GMT
    Etag: "6613e215-31"
    Expires: Mon, 03 Jun 2024 08:25:56 GMT
    Http_x_bd_logid: 1556310859
    Http_x_bd_logid64: 1556310300373367818
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Last-Modified: Mon, 08 Apr 2024 12:24:53 GMT
    Server: apache
  • flag-us
    DNS
    online1.map.bdimg.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    online1.map.bdimg.com
    IN A
    Response
    online1.map.bdimg.com
    IN CNAME
    maponline.jomodns.com
    maponline.jomodns.com
    IN A
    119.188.176.49
  • flag-us
    DNS
    online2.map.bdimg.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    online2.map.bdimg.com
    IN A
    Response
    online2.map.bdimg.com
    IN CNAME
    maponline.jomodns.com
    maponline.jomodns.com
    IN A
    119.188.176.49
  • flag-us
    DNS
    online3.map.bdimg.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    online3.map.bdimg.com
    IN A
    Response
    online3.map.bdimg.com
    IN CNAME
    maponline.jomodns.com
    maponline.jomodns.com
    IN A
    119.188.176.49
  • flag-us
    DNS
    www.download.windowsupdate.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.download.windowsupdate.com
    IN A
    Response
    www.download.windowsupdate.com
    IN CNAME
    www.download.windowsupdate.com.delivery.microsoft.com
    www.download.windowsupdate.com.delivery.microsoft.com
    IN CNAME
    wu-f-net.trafficmanager.net
    wu-f-net.trafficmanager.net
    IN CNAME
    fg.wu.ec.azureedge.net
    fg.wu.ec.azureedge.net
    IN CNAME
    hlb.apr-52dd2-0.edgecastdns.net
    hlb.apr-52dd2-0.edgecastdns.net
    IN CNAME
    cs11.wpc.v0cdn.net
    cs11.wpc.v0cdn.net
    IN A
    93.184.221.240
  • flag-us
    DNS
    bdimg.share.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    bdimg.share.baidu.com
    IN A
    Response
    bdimg.share.baidu.com
    IN CNAME
    share.jomodns.com
    share.jomodns.com
    IN CNAME
    share.n.shifen.com
    share.n.shifen.com
    IN A
    163.177.17.97
    share.n.shifen.com
    IN A
    180.101.212.103
    share.n.shifen.com
    IN A
    182.61.201.93
    share.n.shifen.com
    IN A
    182.61.201.94
    share.n.shifen.com
    IN A
    182.61.244.229
    share.n.shifen.com
    IN A
    14.215.182.161
    share.n.shifen.com
    IN A
    39.156.68.163
    share.n.shifen.com
    IN A
    112.34.113.148
  • flag-us
    DNS
    bdimg.share.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    bdimg.share.baidu.com
    IN A
  • flag-hk
    GET
    http://api.map.baidu.com/images/blank.gif?t=76682387&code=5100
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /images/blank.gif?t=76682387&code=5100 HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Length: 49
    Content-Type: image/gif
    Date: Sun, 02 Jun 2024 08:25:55 GMT
    Etag: "6644dec6-31"
    Expires: Mon, 03 Jun 2024 08:25:55 GMT
    Http_x_bd_logid: 1555560826
    Http_x_bd_logid64: 1555560994098937866
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Last-Modified: Wed, 15 May 2024 16:11:50 GMT
    Server: apache
  • flag-hk
    GET
    http://api.map.baidu.com/images/mapctrls.gif
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /images/mapctrls.gif HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Length: 3099
    Content-Type: image/gif
    Date: Sun, 02 Jun 2024 08:25:55 GMT
    Etag: "663275fb-c1b"
    Expires: Mon, 03 Jun 2024 08:25:55 GMT
    Http_x_bd_logid: 1555564275
    Http_x_bd_logid64: 1555564492764579850
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Last-Modified: Wed, 01 May 2024 17:03:55 GMT
    Server: apache
  • flag-hk
    GET
    http://api.map.baidu.com/getmodules?v=1.1&mod=oppc,control,marker,infowindow
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /getmodules?v=1.1&mod=oppc,control,marker,infowindow HTTP/1.1
    Accept: application/javascript, */*;q=0.8
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Encoding: gzip
    Content-Type: text/javascript;charset=utf-8
    Date: Sun, 02 Jun 2024 08:25:55 GMT
    Expires: Mon, 03 Jun 2024 08:25:55 GMT
    Http_x_bd_logid: 1555561221
    Http_x_bd_logid64: 1555561301665483018
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Server: apache
    Tracecode: 15555612210365439242060216
    Vary: Accept-Encoding
    Transfer-Encoding: chunked
  • flag-hk
    GET
    http://api.map.baidu.com/images/mapctrls11.png
    IEXPLORE.EXE
    Remote address:
    103.235.46.245:80
    Request
    GET /images/mapctrls11.png HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: api.map.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Cache-Control: max-age=86400
    Connection: keep-alive
    Content-Length: 3055
    Content-Type: image/png
    Date: Sun, 02 Jun 2024 08:26:03 GMT
    Etag: "66004f8e-bef"
    Expires: Mon, 03 Jun 2024 08:26:03 GMT
    Http_x_bd_logid: 1563861939
    Http_x_bd_logid64: 1563861093474576394
    Http_x_bd_product: map
    Http_x_bd_subsys: apimap
    Last-Modified: Sun, 24 Mar 2024 16:06:38 GMT
    Server: apache
  • flag-us
    DNS
    online0.map.bdimg.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    online0.map.bdimg.com
    IN A
    Response
    online0.map.bdimg.com
    IN CNAME
    maponline.jomodns.com
    maponline.jomodns.com
    IN A
    119.188.176.49
  • flag-us
    DNS
    app.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    app.baidu.com
    IN A
    Response
    app.baidu.com
    IN CNAME
    appc.n.shifen.com
    appc.n.shifen.com
    IN A
    103.235.47.17
  • flag-hk
    GET
    http://app.baidu.com/map/images/us_mk_icon.png
    IEXPLORE.EXE
    Remote address:
    103.235.47.17:80
    Request
    GET /map/images/us_mk_icon.png HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: app.baidu.com
    Connection: Keep-Alive
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Response
    HTTP/1.1 302 Found
    Connection: keep-alive
    Content-Type: text/html
    Date: Sun, 02 Jun 2024 08:26:04 GMT
    Location: http://m.baidu.com/error.jsp?fr=appsearch
    Server: Apache
    Tracecode: 15645073380322626826060216
    Content-Length: 154
  • flag-us
    DNS
    m.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    m.baidu.com
    IN A
    Response
    m.baidu.com
    IN CNAME
    wap.n.shifen.com
    wap.n.shifen.com
    IN CNAME
    wap.wshifen.com
    wap.wshifen.com
    IN A
    103.235.46.213
    wap.wshifen.com
    IN A
    103.235.46.211
  • flag-us
    DNS
    m.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    m.baidu.com
    IN A
  • flag-us
    DNS
    m.baidu.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    m.baidu.com
    IN A
  • flag-hk
    GET
    http://m.baidu.com/error.jsp?fr=appsearch
    IEXPLORE.EXE
    Remote address:
    103.235.46.213:80
    Request
    GET /error.jsp?fr=appsearch HTTP/1.1
    Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Cookie: BAIDUID=CB3974DB8628D4137C6446D578E69E01:FG=1
    Connection: Keep-Alive
    Host: m.baidu.com
    Response
    HTTP/1.1 200 OK
    Connection: keep-alive
    Content-Encoding: gzip
    Content-Type: text/html
    Date: Sun, 02 Jun 2024 08:26:07 GMT
    Etag: W/"59a948ea-4069"
    Server: apache
    Traceid: 1191829630706842193890721510
    Vary: Accept-Encoding
    Transfer-Encoding: chunked
  • 103.235.46.245:80
    http://api.map.baidu.com/images/bg.png
    http
    IEXPLORE.EXE
    1.8kB
     4.1kB
     17
    11

    HTTP Request

    GET http://api.map.baidu.com/images/blank.gif?t=66734452&code=5000&v=1.1

    HTTP Response

    200

    HTTP Request

    GET http://api.map.baidu.com/images/openhand.cur

    HTTP Response

    200

    HTTP Request

    GET http://api.map.baidu.com/images/bg.png

    HTTP Response

    200
  • 103.235.46.245:80
    http://api.map.baidu.com/images/blank.gif
    http
    IEXPLORE.EXE
    4.9kB
     80.4kB
     61
    72

    HTTP Request

    GET http://api.map.baidu.com/api?key=&v=1.1&services=true

    HTTP Response

    200

    HTTP Request

    GET http://api.map.baidu.com/getscript?v=1.1&ak=&services=true&t=20130716024058

    HTTP Response

    200

    HTTP Request

    GET http://api.map.baidu.com/res/11/bmap.css

    HTTP Response

    200

    HTTP Request

    GET http://api.map.baidu.com/images/copyright_logo.png

    HTTP Response

    200

    HTTP Request

    GET http://api.map.baidu.com/images/blank.gif

    HTTP Response

    200
  • 182.61.200.83:80
    img.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.200.83:80
    img.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online3.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online3.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 103.235.46.245:80
    http://api.map.baidu.com/images/blank.gif?t=76682387&code=5100
    http
    IEXPLORE.EXE
    967 B
     1.7kB
     13
    7

    HTTP Request

    GET http://api.map.baidu.com/images/blank.gif?t=76682387&code=5100

    HTTP Response

    200
  • 103.235.46.245:80
    http://api.map.baidu.com/images/mapctrls.gif
    http
    IEXPLORE.EXE
    995 B
     6.1kB
     14
    9

    HTTP Request

    GET http://api.map.baidu.com/images/mapctrls.gif

    HTTP Response

    200
  • 103.235.46.245:80
    http://api.map.baidu.com/images/mapctrls11.png
    http
    IEXPLORE.EXE
    2.3kB
     29.3kB
     32
    30

    HTTP Request

    GET http://api.map.baidu.com/getmodules?v=1.1&mod=oppc,control,marker,infowindow

    HTTP Response

    200

    HTTP Request

    GET http://api.map.baidu.com/images/mapctrls11.png

    HTTP Response

    200
  • 103.235.46.245:80
    api.map.baidu.com
    IEXPLORE.EXE
    374 B
     52 B
     8
    1
  • 119.188.176.49:80
    online3.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online3.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online3.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online3.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 163.177.17.97:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 163.177.17.97:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 103.235.47.17:80
    app.baidu.com
    IEXPLORE.EXE
    374 B
     52 B
     8
    1
  • 103.235.47.17:80
    http://app.baidu.com/map/images/us_mk_icon.png
    http
    IEXPLORE.EXE
    997 B
     1.5kB
     14
    8

    HTTP Request

    GET http://app.baidu.com/map/images/us_mk_icon.png

    HTTP Response

    302
  • 103.235.46.213:80
    http://m.baidu.com/error.jsp?fr=appsearch
    http
    IEXPLORE.EXE
    1.5kB
     14.1kB
     24
    27

    HTTP Request

    GET http://m.baidu.com/error.jsp?fr=appsearch

    HTTP Response

    200
  • 103.235.46.213:80
    m.baidu.com
    IEXPLORE.EXE
    466 B
     412 B
     10
    10
  • 182.61.200.83:80
    img.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 180.101.212.103:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 180.101.212.103:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.201.93:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.201.93:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 119.188.176.49:80
    online0.map.bdimg.com
    IEXPLORE.EXE
    152 B
     3
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    845 B
     7.7kB
     11
    12
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    799 B
     7.7kB
     10
    13
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls
    iexplore.exe
    827 B
     7.7kB
     10
    13
  • 182.61.201.94:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.201.94:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.244.229:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 182.61.244.229:80
    bdimg.share.baidu.com
    IEXPLORE.EXE
    152 B
     3
  • 8.8.8.8:53
    api.map.baidu.com
    dns
    IEXPLORE.EXE
    63 B
     110 B
     1
    1

    DNS Request

    api.map.baidu.com

    DNS Response

    103.235.46.245

  • 8.8.8.8:53
    img.baidu.com
    dns
    IEXPLORE.EXE
    59 B
     105 B
     1
    1

    DNS Request

    img.baidu.com

    DNS Response

    182.61.200.83

  • 8.8.8.8:53
    online1.map.bdimg.com
    dns
    IEXPLORE.EXE
    67 B
     115 B
     1
    1

    DNS Request

    online1.map.bdimg.com

    DNS Response

    119.188.176.49

  • 8.8.8.8:53
    online2.map.bdimg.com
    dns
    IEXPLORE.EXE
    67 B
     115 B
     1
    1

    DNS Request

    online2.map.bdimg.com

    DNS Response

    119.188.176.49

  • 8.8.8.8:53
    online3.map.bdimg.com
    dns
    IEXPLORE.EXE
    143 B
     416 B
     2
    2

    DNS Request

    online3.map.bdimg.com

    DNS Response

    119.188.176.49

    DNS Request

    www.download.windowsupdate.com

    DNS Response

    93.184.221.240

  • 8.8.8.8:53
    bdimg.share.baidu.com
    dns
    IEXPLORE.EXE
    134 B
     252 B
     2
    1

    DNS Request

    bdimg.share.baidu.com

    DNS Request

    bdimg.share.baidu.com

    DNS Response

    163.177.17.97
    180.101.212.103
    182.61.201.93
    182.61.201.94
    182.61.244.229
    14.215.182.161
    39.156.68.163
    112.34.113.148

  • 8.8.8.8:53
    online0.map.bdimg.com
    dns
    IEXPLORE.EXE
    67 B
     115 B
     1
    1

    DNS Request

    online0.map.bdimg.com

    DNS Response

    119.188.176.49

  • 8.8.8.8:53
    app.baidu.com
    dns
    IEXPLORE.EXE
    59 B
     103 B
     1
    1

    DNS Request

    app.baidu.com

    DNS Response

    103.235.47.17

  • 8.8.8.8:53
    m.baidu.com
    dns
    IEXPLORE.EXE
    171 B
     142 B
     3
    1

    DNS Request

    m.baidu.com

    DNS Request

    m.baidu.com

    DNS Request

    m.baidu.com

    DNS Response

    103.235.46.213
    103.235.46.211

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    db9c778829ea77bffbfa213479888f8c

    SHA1

    fb9fa2fbd76d25607a9cdf027619d79c78bca679

    SHA256

    3b830ff3dd4704e47d0c91cf6ccf773647ff21b66ff8724048aaccf263b8869c

    SHA512

    fd09c6bd26444ff8cb5bdd9d2dd8a99e769d0e296e8ed4205f6da5373a2a176e920d72a41b76b63593632c162cd8a85e9c04c247efc1668a2890e622aac00b69

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f3b262f27a1129487a09a30143ef84ab

    SHA1

    6d412952d61a7dfbcc87637cdf075e53d87634c7

    SHA256

    327a46b4b760d4c615dbe9b0e1de28af19ab1af160030d83a28dd290c48a77ba

    SHA512

    c7a7f97d31cae8055c00421fe85bdbeba6e46d73f013336a0c3883a08de08869fa6b0f9312283eb476a945ef4f09f16345de81b007e8c525d68e032f3cc56c39

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    9d5e69172a8cd52b29f8d4c0670187e0

    SHA1

    59320f48d8ef9e32083756a51c8d154d59dd38e7

    SHA256

    4a59917bec5d16f088c1bf3e2076e260d517684b78f048fb4fde7af3fee2f315

    SHA512

    7cedea28dc47cdcf341cda078869faa54c58563e637c63c9ff25debfb44b14f314fb4214b488fa0ba1f68ec71969ac80f428ac1cf9b9e611c5d0d8202c52af8c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    78252f1522ef1f1adb5a3606674c457f

    SHA1

    30d2830b4e2e6178c551a48bdd37ca283c8f2510

    SHA256

    6720b56baad308111fa5ac4d9e7840cc2a8f66b4418f767accfe4881df9cbcbb

    SHA512

    a8687ce8c967a1d5b7a2b82465226ad865e3a4ea9dcaae6f05b15c8b3af800c53e0b24ace2ba34c32ccaa57802200ebaecb858d8ca25878c33464272c66de9de

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    ae5c7dd62fdd8ba994d1840ffb851d85

    SHA1

    9b23488aff328f1b9e3f784cafc0a89e4670d55b

    SHA256

    41228d25638178a6a921ea8d60002074b3c3480e550e218a0e874965030af92f

    SHA512

    6240017d13c20c245b7b5c67b6360bb288e88c7dc11287aaa9128c3d6531f2e56fce33cf3dc6a41c4749543046824b97e59e5898415440e0462440a20964d0bc

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    bc875d6c569f739646a3827f32d73884

    SHA1

    b5e028350c9343da0b6f5200f52f455dc8d4d25a

    SHA256

    da2a41d3cb825083bd0ef68f35e5f395472a9dc5af0d0b53a9996e316f65a6c5

    SHA512

    e8d0851f1f0fe19317d44423856e27fb5496e8682bd25742be57fd3c178510fbd65fe28d007036b8a3da8728bcc6a36a268cc49eb01111da501ee005fd962184

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    f5557fcf69c006b1cdcff4db9ac3f671

    SHA1

    4ca789a3827ef9af945102111c35d13b325dc79d

    SHA256

    f7487478185be0f4ea96afbeb09e84852b154f117e9f98f87058720aa1c25580

    SHA512

    4425f8dfb142b89a846053a12bbad35b2f68a6572ac73271a15875fc8f47024c5fce50a99b8f5ea3942a5a7974bcdefba08a6fecf53e525498fcea22d1fdd3e9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    0ce7a34e3744e872de9187d9455f116b

    SHA1

    13ac44c9f89c4e78542546e5d345f6372beafba1

    SHA256

    ca2e1607b1ae341101d79a377b1a1e28231bcd92a293f060d4ed80c851d34470

    SHA512

    ffb5c94e106b9d773c06327a271286eea3cc46cd7b3f7e22eb04e274fa513ae2e9661fe72ddfc156cd7acf0a6930056e021312a8becd98f1f37d5731bb36b91d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    23af73e59f9ca848daa099c71dfb052e

    SHA1

    2c06ed9ac23f7a988a30e87a727dc1fd087cfedb

    SHA256

    147b1038be45ca085440bf652dfd9c30be8ac8edbb9d61264c15b863b2715f16

    SHA512

    ba8db1312818d421a0bbb95cd2e9457fd3c257fa71d6e02cf8855d1018ade8fdb1b9052fd463e185374348f279f6a4043fd9fce77b9c37c62cb0c65ffbe8829d

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    c3b370d5d5769f42b6d5967dbb259ff1

    SHA1

    a9cd8b1d72f7ec3c55285dfc1a38225163351ded

    SHA256

    935168ede871db0114f21f4b0d01ae754fe4a9b4fade8998cc9b637f40032bee

    SHA512

    eea86d83c90e6c6c9f2f2861a821db443f48d1760fb8c2321a546be7277350c29ca68adcd17dd44dcb9e89cfca78efbf427b719d46696b2bb73e6e7693ec910e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    ca958102d59d9a5c59e3f59852fe1e68

    SHA1

    d456c892fca440e5126cd92df3851ddea80459f1

    SHA256

    abb4287362eded0b14c2841af4599826b495bbf8c73b7959b8c9b4e713740a38

    SHA512

    15f9fe8ecc568937d8aea920632bf672405ca8a60c0207bf385e97a9c36c39a5541e3d83829e35dafd8bb47c510f1fc330f31a0d7f72f2189dbf786a642252c2

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    5348408ed7e1b9eebdae9606c3c675c9

    SHA1

    f8240a98801d9f8472637c5853517241e7200245

    SHA256

    1259da14bdad25d696ea638ef254ba1be6d11140dd02ae737c31454a566ed9bb

    SHA512

    186e7da6531eae574435b70e1973b7f204dc5dbec11dba74d15cd5ecf2ff03fe1433477762d953d70a3d7bbd01ead1e3cae9d03b3b9dd9e0c60d6d38187edf3c

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    824e31580bb22901397d02e18465aee8

    SHA1

    a37a866292a791e67610dcab0f1f18634c93c127

    SHA256

    375561aff27ca204c4de1808b4fe7428ecbee93224541430510c5a812a759e1f

    SHA512

    f781d50a7b00f95e5eb1a5521d539176bf172069b74a223e35f69250d2069f01fc90293d1c5563618561aa0e1d64d227801366273512cd7a1eb8c092cb65597a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    a6d712208baffa469e2563c9e267a1ef

    SHA1

    95de763a50bc24e87acd6cc701b0ff9fde2c0d00

    SHA256

    222080eaff94e2abbe48dc082753df760286baa9aa2a54c2c681a6a8de086b4e

    SHA512

    f702ddce2320b309d97a824132aa54a66aca19c90a71ab45d02a81caf348c5b4a538982044543ac0b347c4cc5acaf5bc2e25bb62a026b4cf164ca439a6edc11e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    c40e34ca2f8d3411beaec06c3f4359b7

    SHA1

    d6f8a69ac56515226fd963dcf354d5bf42b873d6

    SHA256

    57d89f19c474140123344e1129d142caf59c06f98844af6cf7785d68e744cef7

    SHA512

    08b6154c12866875410619c34055bb2899368197661f34986a7e14fd4439b8a683d9612ba334463e8dc5abf05dd08e0a49bb0f058c72c8f5d0e24f416e7440c1

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L9PN2QMY\openhand[1].cur
    Filesize

    326B

    MD5

    feff9159f56cb2069041d660b484eb07

    SHA1

    0d0a08cf25a258511957f357b89d3908f3c5e6e3

    SHA256

    7342f390b12f636d14e25f698fc5e38cf6240994dc0c07fefbbb4e78ec4d03c7

    SHA512

    f850277f48ac14fa363265469776e6f7f07f7dd743aa1d1ad7cf2329eee6d323da3422cf6baac066c84ecd24800a02088053ef3fc0488d170e7fc942ac8ffa99

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab8AA5.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar8BE4.tmp
    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.