Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/06/2024, 15:44 UTC
General
-
Target
aa801c4bbd08e121cd551dad216ed760_JaffaCakes118.html
-
Size
30KB
-
MD5
aa801c4bbd08e121cd551dad216ed760
-
SHA1
239239ea9b4126651fc5da3e429d6ab3cfadc289
-
SHA256
d47cd88207cf8143ad36ae6c2c791a2852f2a5c1fc51f0473067e04b34ea8993
-
SHA512
f7059e65f2aa3500790364dc3258f884ff02c3796a9667017d6cb883617caf97f8a3ffe10edf3ab0e4fe40f11e694ff7d2caa44035a2c4ff759599de9d498953
-
SSDEEP
384:SbHAoGzygTeyUtTmF3i2hV+5cxiGUvMt/FHnw6xKZyRtcfx3yn:SbizyIeyUUO5UYT6x4yn
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 36 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\aa801c4bbd08e121cd551dad216ed760_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
Network
-
DNSgraph.facebook.comRemote address:8.8.8.8:53Requestgraph.facebook.comIN AResponsegraph.facebook.comIN CNAMEstar.c10r.facebook.comstar.c10r.facebook.comIN A157.240.221.18 -
DNSquangphu.infoRemote address:8.8.8.8:53Requestquangphu.infoIN AResponse
-
DNSsites.google.comRemote address:8.8.8.8:53Requestsites.google.comIN AResponsesites.google.comIN A142.250.179.238
-
GEThttps://graph.facebook.com/0/pictureRemote address:157.240.221.18:443RequestGET /0/picture HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: graph.facebook.com
Connection: Keep-Alive
ResponseHTTP/1.1 400 Bad Request
Content-Encoding: gzip
Vary: Origin
Vary: Accept-Encoding
Content-Type: application/json; charset=UTF-8
WWW-Authenticate: OAuth "Facebook Platform" "invalid_request" "Unsupported get request. Please read the Graph API documentation at https://developers.facebook.com/docs/graph-api"
Access-Control-Allow-Origin: *
facebook-api-version: v14.0
Strict-Transport-Security: max-age=15552000; preload
Pragma: no-cache
Cache-Control: no-store
Expires: Sat, 01 Jan 2000 00:00:00 GMT
x-fb-request-id: APLGksywyDJhPGa5DL7LCxb
x-fb-trace-id: HQHQE4l+0K+
x-fb-rev: 1014228662
X-FB-Debug: 8HfS+nhPbuox468m3cBB+gQIT0g4PgmS4VjWE4y10Wf0WA8bPQU4HEwF+R/8GtVhXV2NO/W8mKfLJ8IT6IcQow==
Date: Fri, 14 Jun 2024 15:44:54 GMT
Proxy-Status: http_request_error; e_fb_configversion="AcJ_7_2P0XpTeMKitjyFwHlF97LmjN0n1rSz71ncR-Hmf7n3r9UqR5yFOThAEQ"; e_fb_vipport="AcJQtwJRiw3s5AyqAglb8dTLpy2CMcmQSMN4qzTYWC_z2EE8uZSdNIkw4BcO"; e_upip="AcLg_PA57_XaMv5d8JKHbbegL3jzXAzM63-E09ml1_4yt9m-UXodwZMYja9iVfXVNOG-2eabYGVfKWu105UDokYt5qcsdvdqH3w"; e_fb_requestsequencenumber="AcJrgGF437W3qPTib8cOxmZAtGdXmHjTzKEUKao-ADAa-877_Zdaj3jYs-Tjcw"; e_fb_responsebytes="AcLXAaAsfYFrk2ibgJbiABP-bNeh_WylnwgVAxuFWqqt5ouJA9cUmt0yhiVD"; e_fb_hostheader="AcLGlsfGuNZCac6nuKovsoPpnAu8ylzL0BcCfKm0iQ1LySKqYg_CBKn-X8DbmNzq3YytoQDchHkn8n-k"; e_fb_vipaddr="AcL0Tc20su499rY9Bivk-UGN3QkaSsulIXZREZxpSnIETvjxmGDQB0QHu9JoujFqHZa94gyOpEJ5qeBsSkUczmMF5D0UYdcB2A"; e_fb_requesthandler="AcJUMNein0AmLRA-7B_Z6yS6BugmHHe0dF2xZQBsKDcfyLIN0sw20YXjClLRMK85ERQZ_e46CRI"; e_fb_requesttime="AcLXJz160n0oXr4OGL98QARrjlLvHLrbKIelKcWJrPzvGUZU35QBrReh9GLmoZPEM9vESbgvfw"; e_fb_builduser="AcI-m1IMBHLCYiesYzwJQAl7H-u8fNHnlKNHPQzmhczkEJFQxRgCFs6W5TJdl68gl64"; e_fb_httpversion="AcLml_uvhT7yYHOpbMeqasqx-Zf15NDJcNyATQ3W0F1SiI_1YO2gynntYO-_"; e_fb_binaryversion="AcJTZOOm-f9Tad1ASl8kxxGfvxmnS_aW2RHXfdVXKT5OlSzZ_44IvLkFIOHFoaE7AK-kA2uqHPR9pemBnioF239aHc9yxV7gd0o"; e_proxy="AcLAPQFDuAlBlDbJdX4AyRV6TlmLfsy4olJtcAKAoUiM-FS70QK3xbd7PnCY4H_SP69gWxYBS92uxUFyx_I-", http_request_error; e_fb_configversion="AcLHVhj6OKgIDX2gnVNPx7T99se6g0wFBIrfuMvRJa6SyYQmgAhQxrAzKUvZwg"; e_fb_vipport="AcLO1865HDg2sZK_jbh1XZNAY6bxuvPM4T83IoEy0sf7Cl4e3Wku3FHMSS6X"; e_upip="AcKo8U5QbJuU-a3caur6MELhQn6Sy03uDqwBd3H75tgXZNtYnHBbg6khUGXOHXX5wWB9FiUP9HTyl_F7ttmW-nZtCOYnF4WoXA"; e_fb_requestsequencenumber="AcJyx8p12B3zjyAsYRNQtpLq-jbo1zuZUXoHGIZKt6jEe_3Uf28T4191iw"; e_fb_responsebytes="AcIMumexrDvzAUgAhQ8Sk97n6mqSxx6rP7dtC8hcfdkVnz5OSMU3XqzWIaE8"; e_fb_hostheader="AcL57SAzOAVguaIAfNnGxgOdbg2ruMsoyjZRKP4gCspbgrXmJ3LNZsbUgjXBIGaB5mf_HlkjHNdhuvq_"; e_fb_vipaddr="AcKfhcyxa1MzrE1vyt9KaP-HzM8JYGhF39R2vtGLogMvRLMxQL-P7fBtRvjA9ndTBk_1-qT4KC4"; e_fb_requesthandler="AcLj5yxjCA74RePxundrr0TcmQhwTGO7hBj01jKeoWnEC-njUINFMmxtog6DYELgabRrp2_4Vvw"; e_fb_requesttime="AcLC6dT07Ib6kvHVP-3zyJykcgC_jhkyJILOCow8Cjepipv9TsM2KI7tZPatHVdhlBywVsNS0Q"; e_fb_builduser="AcLYqlH2-h7iouzcG3Eh_Og75PbczG-vDQqj7otTta7p3a0_-ZGGUdDfmX6HZGVCmWA"; e_fb_httpversion="AcISsy_eM8Te8VhiArFQZH33Q_dzXf5a7SP7k6O2LUp4ruJdU1_veHCG-feR"; e_fb_binaryversion="AcJu4je457_WaxqiLTaOIPxGGNhjsJbZLXfWrGemBM0xpKgSrKVMip30J385P2tk4Liwne2grz6m6E6bo-wHzlLr1CyeNH4Io8k"; e_proxy="AcLkwtnAMfOCm7sde8-JsAwJR01qbmd6QcS2T0AMHJPRuTUdXk4Qvf2s_XmkvMfdLCa0ZLbflGNDf5I"
X-FB-Connection-Quality: GOOD; q=0.7, rtt=65, rtx=0, c=10, mss=1357, tbw=3224, tp=-1, tpl=-1, uplat=16, ullat=0
Alt-Svc: h3=":443"; ma=86400
Connection: keep-alive
Content-Length: 224
-
GEThttps://sites.google.com/site/tessssssssblog/code_auto_like.jsRemote address:142.250.179.238:443RequestGET /site/tessssssssblog/code_auto_like.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: sites.google.com
Connection: Keep-Alive
ResponseHTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=UTF-8
Location: https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path=%2Ftessssssssblog%2Fcode_auto_like.js
Content-Encoding: gzip
Date: Fri, 14 Jun 2024 15:44:53 GMT
Expires: Fri, 14 Jun 2024 15:44:53 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self'
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
-
GEThttps://sites.google.com/site/sites/system/errors/WebspaceNotFound?path=%2Ftessssssssblog%2Fcode_auto_like.jsRemote address:142.250.179.238:443RequestGET /site/sites/system/errors/WebspaceNotFound?path=%2Ftessssssssblog%2Fcode_auto_like.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: sites.google.com
Connection: Keep-Alive
ResponseHTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=UTF-8
X-Frame-Options: DENY
Last-Modified: Wed, 05 Jun 2024 21:50:32 GMT
ETag: "1717624232000|#public|0|en|||0|883462680|640834270"
Location: https://accounts.google.com/ServiceLogin?service=jotspot&passive=1209600&continue=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&followup=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js
Content-Encoding: gzip
Date: Fri, 14 Jun 2024 15:44:53 GMT
Expires: Fri, 14 Jun 2024 15:44:53 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
-
DNSaccounts.google.comRemote address:8.8.8.8:53Requestaccounts.google.comIN AResponseaccounts.google.comIN A142.250.27.84
-
GEThttps://accounts.google.com/ServiceLogin?service=jotspot&passive=1209600&continue=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&followup=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.jsRemote address:142.250.27.84:443RequestGET /ServiceLogin?service=jotspot&passive=1209600&continue=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&followup=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: accounts.google.com
Connection: Keep-Alive
ResponseHTTP/1.1 302 Found
Content-Type: application/binary
Set-Cookie: __Host-GAPS=1:xEOoDYRGhkeX8Qb-iQoI2TlGhRgspg:8i2iNnNGnGfZbi2O; Expires=Sun, 14-Jun-2026 15:44:54 GMT; Path=/; Secure; HttpOnly; Priority=HIGH
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 14 Jun 2024 15:44:54 GMT
Location: https://accounts.google.com/InteractiveLogin?continue=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&followup=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&passive=1209600&service=jotspot&ifkv=AS5LTAQSDXz0rDkBEGnYhuUYbB0e_LVglIrCtgjZCLMC-cLsEgGrqT6k0tvLZdPo2GatuovnSCKL
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: script-src 'nonce-uzJaGUEx4rx7Ir6DtpI9gw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/AccountsSigninPassiveLoginHttp/cspreport
Cross-Origin-Resource-Policy: cross-origin
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: unsafe-none
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
-
GEThttps://accounts.google.com/InteractiveLogin?continue=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&followup=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&passive=1209600&service=jotspot&ifkv=AS5LTAQSDXz0rDkBEGnYhuUYbB0e_LVglIrCtgjZCLMC-cLsEgGrqT6k0tvLZdPo2GatuovnSCKLRemote address:142.250.27.84:443RequestGET /InteractiveLogin?continue=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&followup=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&passive=1209600&service=jotspot&ifkv=AS5LTAQSDXz0rDkBEGnYhuUYbB0e_LVglIrCtgjZCLMC-cLsEgGrqT6k0tvLZdPo2GatuovnSCKL HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: accounts.google.com
Connection: Keep-Alive
Cookie: __Host-GAPS=1:xEOoDYRGhkeX8Qb-iQoI2TlGhRgspg:8i2iNnNGnGfZbi2O
ResponseHTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=UTF-8
X-Frame-Options: DENY
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 14 Jun 2024 15:44:54 GMT
Location: https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&followup=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&ifkv=AS5LTATVIECtqXjLBbSzITbYhDdI88eQX2vzPEJC5YWZ85AamS0x_-ZKDVmQsqr6sikS-x0qVn1zog&passive=1209600&service=jotspot&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1978928518%3A1718379894282108&ddm=0
Strict-Transport-Security: max-age=31536000; includeSubDomains
Report-To: {"group":"coop_gse_qebhlk","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gse_qebhlk"}]}
Content-Security-Policy: script-src 'nonce-FwKguuyGPqWxfnBAZMS2ZA' 'unsafe-inline' 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /cspreport
Content-Security-Policy: require-trusted-types-for 'script';report-uri /cspreport
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop_gse_qebhlk"
Content-Encoding: gzip
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Server: GSE
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
-
GEThttps://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&followup=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&ifkv=AS5LTATVIECtqXjLBbSzITbYhDdI88eQX2vzPEJC5YWZ85AamS0x_-ZKDVmQsqr6sikS-x0qVn1zog&passive=1209600&service=jotspot&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1978928518%3A1718379894282108&ddm=0Remote address:142.250.27.84:443RequestGET /v3/signin/identifier?continue=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&followup=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&ifkv=AS5LTATVIECtqXjLBbSzITbYhDdI88eQX2vzPEJC5YWZ85AamS0x_-ZKDVmQsqr6sikS-x0qVn1zog&passive=1209600&service=jotspot&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1978928518%3A1718379894282108&ddm=0 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: accounts.google.com
Connection: Keep-Alive
Cookie: __Host-GAPS=1:xEOoDYRGhkeX8Qb-iQoI2TlGhRgspg:8i2iNnNGnGfZbi2O
ResponseHTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
X-Frame-Options: DENY
Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
x-auto-login: realm=com.google&args=service%3Djotspot%26continue%3Dhttps://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%253D/tessssssssblog/code_auto_like.js
Link: <https://workspace.google.com/intl/en-US/products/sites/>; rel="canonical"
x-ua-compatible: IE=edge
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Fri, 14 Jun 2024 15:44:54 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: require-trusted-types-for 'script';report-uri /v3/signin/_/AccountsSignInUi/cspreport
Content-Security-Policy: script-src 'nonce-ef5LLmoNaV8Qvph8-zaAPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /v3/signin/_/AccountsSignInUi/cspreport;worker-src 'self'
Report-To: {"group":"AccountsSignInUi","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/AccountsSignInUi"}]}
Cross-Origin-Resource-Policy: same-site
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="AccountsSignInUi"
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factor=*, ch-ua-platform=*, ch-ua-platform-version=*
reporting-endpoints: default="/v3/signin/_/AccountsSignInUi/web-reports?context=eJzjusOoxSXF4KIhxbBfaReTY-wTJlcgXv7-KdNqII5Z9YwpAYgPxj1nOgrEeeeeMxUB8duEF0wfgbir9QVTHxBv7nnBtB2Ip_G8ZJoFxEe2v2Q6AcQSX18yaQCx_K_prMpA7JQ-gzUIiH3qZ7DGAHHrzXOsU4E4-Ph51nAgvgbEt4A46d951iIg3ilygXUvEM-yuMA6D4iP7LvAegKI2z9fYJ0OxKn6F1kzgVjQ7SKrKBAvibjIeijxImtX8UXWPiAW4uH4dmrjZjaBB59XbWJU0k_KL4zPTEnNK8ksqUwrys8rSc1LSSwtySjNLE4tKkstijcyMDIxMDOw1DOwiC8wAACRx3-O"
Content-Encoding: gzip
Server: ESF
X-XSS-Protection: 0
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Transfer-Encoding: chunked
-
DNSwww.microsoft.comRemote address:8.8.8.8:53Requestwww.microsoft.comIN AResponsewww.microsoft.comIN CNAMEwww.microsoft.com-c-3.edgekey.netwww.microsoft.com-c-3.edgekey.netIN CNAMEwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netIN CNAMEe13678.dscb.akamaiedge.nete13678.dscb.akamaiedge.netIN A23.200.189.225
-
DNSwww.microsoft.comRemote address:8.8.8.8:53Requestwww.microsoft.comIN AResponsewww.microsoft.comIN CNAMEwww.microsoft.com-c-3.edgekey.netwww.microsoft.com-c-3.edgekey.netIN CNAMEwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netIN CNAMEe13678.dscb.akamaiedge.nete13678.dscb.akamaiedge.netIN A23.200.189.225
-
157.240.221.18:443graph.facebook.comtls
-
157.240.221.18:443https://graph.facebook.com/0/picturetls, http
HTTP Request
GET https://graph.facebook.com/0/pictureHTTP Response
400 -
142.250.179.238:443sites.google.comtls
-
142.250.179.238:443https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path=%2Ftessssssssblog%2Fcode_auto_like.jstls, http
HTTP Request
GET https://sites.google.com/site/tessssssssblog/code_auto_like.jsHTTP Response
302HTTP Request
GET https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path=%2Ftessssssssblog%2Fcode_auto_like.jsHTTP Response
302 -
142.250.27.84:443accounts.google.comtls
-
142.250.27.84:443https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&followup=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&ifkv=AS5LTATVIECtqXjLBbSzITbYhDdI88eQX2vzPEJC5YWZ85AamS0x_-ZKDVmQsqr6sikS-x0qVn1zog&passive=1209600&service=jotspot&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1978928518%3A1718379894282108&ddm=0tls, http
HTTP Request
GET https://accounts.google.com/ServiceLogin?service=jotspot&passive=1209600&continue=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&followup=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.jsHTTP Response
302HTTP Request
GET https://accounts.google.com/InteractiveLogin?continue=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&followup=https://sites.google.com/site/sites/system/errors/WebspaceNotFound?path%3D/tessssssssblog/code_auto_like.js&passive=1209600&service=jotspot&ifkv=AS5LTAQSDXz0rDkBEGnYhuUYbB0e_LVglIrCtgjZCLMC-cLsEgGrqT6k0tvLZdPo2GatuovnSCKLHTTP Response
302HTTP Request
GET https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&followup=https%3A%2F%2Fsites.google.com%2Fsite%2Fsites%2Fsystem%2Ferrors%2FWebspaceNotFound%3Fpath%3D%2Ftessssssssblog%2Fcode_auto_like.js&ifkv=AS5LTATVIECtqXjLBbSzITbYhDdI88eQX2vzPEJC5YWZ85AamS0x_-ZKDVmQsqr6sikS-x0qVn1zog&passive=1209600&service=jotspot&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-1978928518%3A1718379894282108&ddm=0HTTP Response
200 -
204.79.197.200:443ieonline.microsoft.comtls
-
204.79.197.200:443ieonline.microsoft.comtls
-
204.79.197.200:443ieonline.microsoft.comtls
-
8.8.8.8:53graph.facebook.comdns
DNS Request
graph.facebook.com
DNS Response
157.240.221.18
-
8.8.8.8:53quangphu.infodns
DNS Request
quangphu.info
-
8.8.8.8:53sites.google.comdns
DNS Request
sites.google.com
DNS Response
142.250.179.238
-
8.8.8.8:53accounts.google.comdns
DNS Request
accounts.google.com
DNS Response
142.250.27.84
-
8.8.8.8:53www.microsoft.comdns
DNS Request
www.microsoft.com
DNS Response
23.200.189.225
-
8.8.8.8:53www.microsoft.comdns
DNS Request
www.microsoft.com
DNS Response
23.200.189.225
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
252B
MD5f11c3dbf392e0ab586e72c1005cc0076
SHA1f8b1bf32b0b2e91db14c2eee864f6b1548c6bbaf
SHA25631395394b16ae0b17655a33ab906b9c8dde65fdd43524810b7b90d2b2e2a40a6
SHA5124271e3f1aa6d426a4fc52f9c3a43991684214d6849511d0407706e63572c329bc6223df8e634287dc17ec9c180597af485031e98a61d8ee38516a24371224428
-
Filesize
342B
MD5aa97244aa897e84028e26c79811c2d1f
SHA198f7397c535230ce6671d08fb2e098cdcca58a6b
SHA2565c09912b4d609a670467f3a38ff3d2e45af9bff8b989399b4e649fade80a07f7
SHA51204137b8b257edde36a7293bdaa0744c76bb6c467bfdfeb75741a0605545ca6158a768b818db6cbc6003b653d343c6c6239bd5a9cb9327fa706485ca5fab95a39
-
Filesize
342B
MD581d7ddca68e816d1ca52af08a40bc2a1
SHA122708e558dd5bd9a93e637cdcceb3c5c045135d6
SHA256b822d4e6fbb7bb574e544abd348113f5feafaf0e6bcf1383b04dea0dfc402688
SHA512bd3606a23db7e87469ce30b74db6bfdd11a440333254626fedb98d78419a33a751f5be0d771a90e4dc46470cd31bce84d8dca83c80aea65d7eb4ca0ccf4ab8e4
-
Filesize
342B
MD59cdacb84fb19ae5142539d460059dbc0
SHA184c558afa0769f2e5012c8f7ae71a5761571060a
SHA2565388d1601512421e1ea63d7e03cdfd86cf5e1c0ef30ddcb7a0bdfc0239f0cc3b
SHA51223be122fd81dc3c6361c5bc9f8b05b7a61e9c858fa7c8bdf769ccf15555202adfe6d2b8fa84a438557eba907f574c719b4e0193b022cab0b0fad30443a116609
-
Filesize
342B
MD53c1bed2b6c94c7408740e5b0a90b3dda
SHA17f44433546eaef9f529a08805a0791cf67534a03
SHA256e200165c0871f72c85d0ba495b9d987a7b58ad978c8f2be3dd570c73ded7fa7e
SHA51278810b4e25c92f20a3ee225dbe5fbb92fed978eef8eaf7dfe7bbafa587cec6b274fb1c1c97369d44b3ca32a6bb9cf58ac3b37766593f7ef4bf6da8fe57a21ea6
-
Filesize
342B
MD5207854e8ec81872ea1c0185c28e3a268
SHA1cdfe3bdca1bc69ce926c3bf84a04b4a34fdbc1ea
SHA256c2f9d03210513fad0c4a9629b6fc563e853dd84e2ef4a0f8c4479b12a727ae9f
SHA512fcb1bd8fdff5a4b91d8ce7ca385eab53304ce48749737d632e21eba397e2566a39b621534bc22347314544b822e3f1173b717399a4f579d2f438b6327b900fe2
-
Filesize
342B
MD54f9db2c9c813a73cf67e35ce05bb6b85
SHA128dc8f6640e5d8709c629f2c25c0876150106a35
SHA256fd74553559b1fe7e18a15eae0c6d025bb56222bb8f32103a29847f6c4c8f4862
SHA5126fdf8dc1ad3aba3a08e386d0137204c1ddcb894c4bf6d7fe2ed3b54e89296d881f6138e5abf36127cfb671cb57d870f81f4f202ad32814242672883584c45af2
-
Filesize
342B
MD5a799f72da51ce2feacc01f8b03c80c98
SHA125250bca6bf37ce6dfb52376d3b1cc629b0cd89a
SHA25684b62c19cb6f124f80997d402be7519ce709a653fa94b0caaa44be604f2520a4
SHA512c2335c78b1a0b8685a349de8dbb2a1fea16740f1b289b47f6800a8c351690e65a265097b285d7129e85728a2f7d0760de2013a1ce2186c92fa646e26f19189a9
-
Filesize
342B
MD55c0075e625580ce08041d999645b6f85
SHA15330d9fa6bd2c4ccd3ed8c00b28ee591af8b7b6c
SHA2561eb4de963a2aabeee30be413ba88b3524bee28763e43dfd33fddf7faa79ca94d
SHA5121a1533d6897e35f5dedd26791a44db4a0f47c51690d0289ac1bfaa2f662cae2c6366f3f6e6e2a59f3cfa080bb2d35d34042a7cc083ca10e3c5f50be5dee6531c
-
Filesize
342B
MD53d183005059c03049e0b24a5c74cf473
SHA112ba4a29eedb94403b5badc677ede0b5b1131b79
SHA256510335fa7b2f23da91d063f8473ac8e25903c79e9d0dc6a4d32d3f31b73c4504
SHA5127eab4947f6dd58b32a4fbeb693ff91b1defc3be05cd98f4ce9ec0d93f45112d22df0fb5ebb852016ddda768271cee2d4e877220aa3f217ffd58f99ca8d0cb19b
-
Filesize
342B
MD5e6851b424fc62de42f356669d6543f04
SHA174f39d802fe89547dbabf4b090cd0e82b4885525
SHA25651b298cdb6e965e1a66c69760a78296c6b56a1e2b33054127b220ab0176efc3b
SHA5124e7051f361cb627e5dea8c79a3a2dee35aecc33a75346ad5d37f136de69c468ffb45122d9a177c66920df1c5d82e9f5cc8dd8c52cc0202612e6025bae8426a49
-
Filesize
342B
MD5cb07fdbbdcfdd1cc241c37a1ddf32776
SHA153acc3d67eb84826f7d442b21deed05d094a02b2
SHA25656616d6c85f0ae38155132e8ddd5c63ec7d9c791913d3846afdd4227a5126cf3
SHA512f4e574162f91408f3b93f26293f5623cb4722734bdfb62c9db80f6ce7dba69fbb81512571f280fbce912ee1ce8ac8a3997163d7df994f185cba16b765356ffb7
-
Filesize
342B
MD5fac96183a718dfe803e8d380b5e5ad6f
SHA128cd475805e28295f9a9c1592f611466787d5538
SHA256aa11a150e735d904a436b4553af445c8c758f17738e66f0a5bbd8477f77304dd
SHA5125cc7518f79b5a8aeaf3a93de95bc8e94610fa4673e71d5921033ad7ac09af3fdad08aa1ccd5e1f5093db1b070fad176dfc52a06ce8a67d7ba904d4cd5fecef48
-
Filesize
342B
MD59cbf0f4bc24952e6a7c1535aa6926af5
SHA15721263ccd9b90a34d9d59a7c666af1a859d3e80
SHA2567d629cb02efa6bcc7b30a8357e4fc9310ffc6e2dd14dc825eaadb3897ed5a1b6
SHA5120d2ae973cc77d1aa7cddd66f7413c60d983a1db7cf28d171281027fcd3bcd158232b46acd5a027fb04277a4d8a9b1a56573b7cdd15a15c29978e5689593a082d
-
Filesize
342B
MD5887df68f8b9bb8c55a87a18c14efce69
SHA1ea02513d7695bff64eb06cdfe2264b52127d3e58
SHA25656d893ac97d0575a91e902f35c045f215963a1cf85c399b020f4130349d67ad3
SHA51277463e31d3ec61367d33a9ef9eb82ec2a3c7d98b161bbd206e3f8ae3f4e0fd31e833d28a4a73e7332b5b06cf20a81f3976d2f28448732ca13c4fa7735eb4e8c2
-
Filesize
342B
MD51558135b9354e99a071d401f5d0fab3f
SHA1cb1fe634c9b7c107f04b0f6c8b016711eb81e900
SHA2569c62271cef55a864d7ded5521c8cabe41735eb3fa3bed9956f42a95e6ad70355
SHA5127abcc723600fb5324b2b8c56bbece66ed7122844089e1da001db2116d38c740b15a5c8fd0c6034dbb304f7d311e0590306de4ad3ee88c5e65276759cffe54f41
-
Filesize
342B
MD52715bf86cc6c2441aa148956dad89c2d
SHA1db4b4d7e4b70417bba91a5ae51e4f89e66dba26d
SHA25681367e5b6e2cb5f7ef32aae095abbe61c2b4601ab487dec47d73df22e589c2b5
SHA5128399418b7dff035a72203188ef576487d02df699c384fbbf6109111ef3791fcb6b0fb518bc93477acd6e70898b853d10987c577d7dd384a4507ff4572c124eb9
-
Filesize
342B
MD5a4c9a6fdfb15f94a70fda91e7f07f0eb
SHA1c321b0ce01ecf0dee4577db24d959f4b05ea12c4
SHA25697af869d8b84420920dc9631c2e298d6cd3cce8a2cb3f284d170f75784d1c05f
SHA512727b92c3c8aaa81c5508b0706ffa8ec2c92b879f688bbbd4e193c410a6ee35197ec24862290b2356c9486b8c81233045b61b3c9f7897ba48f3a982856d4e18d0
-
Filesize
342B
MD5658580fb2e53255fd1d9d27dd71f5b7f
SHA19732209e50e73bf9f4d22c0c12868be6f580ae53
SHA256ffc1a3fe3467a97783ad1b69c4c99af98046a46dc44c677a1d016314a3347b5b
SHA512308b4b03bda9757b0426e71d6ef85363916676323462218f0d8c68f4aad50ab0cd23edd48653095eaa5157dac47f86481d9895f0d023f655508704290294abd4
-
Filesize
342B
MD54682e578b2a90d148d44cab7f39be833
SHA18292b39186226a13c0531e6454578c789f1d07b5
SHA2566c2b806cc8f2054258a67de7cf285e2c4770fb56bbc80ec49625158cb3cf41ec
SHA512f955cafe7583a1f883f60be63e1a9b6f0e59d2d4f485499a3abb999dbe3c273303f5fe0deff59861d0b59c5074c181377d2d047502e2a3d8debbf9903579a0a7
-
Filesize
342B
MD5c875d8029c70e89bb764cd680b520d91
SHA1d9ffc3a0fabb1d0dea88fb79cb7464704362529a
SHA256644ac96d15ab1e5127faa5f861e9f5316fdaf6f70919d044f0268aa2c4663f4c
SHA51245e0fff6e41c93ac5ee784cb4731367d4ef156a011ea358b4ad6c20a41559dcc2e67250d31950ab10fd9307eb2d901c2c2e78d82c32cc3d4aeabf1de31cca912
-
Filesize
342B
MD54a03a9148dbfa935d19b72536f764acf
SHA1ab7069864ad2bb5daf7b4df68a9af9f88958d5cc
SHA2560fbae15e639e9fac7533b0252766ce2f6e86b1036bb06c4aa93b71cf791d08d9
SHA5122f2e0c45779508df17770cf2c982653b20b0010cdd223638fcc54fd10747fa3e4502830d2bcba302db97825f93e987cced7dacb56079f2a44a583147754fc865
-
Filesize
242B
MD512725cdddb11d719391a01143212e104
SHA1a0874bb6ce720bd43d6355f5476340d05e50f37b
SHA25613e3ff0121daca039f8a3236ab0c8e0ad8e6c57906d384c690ef90c074e7d5c4
SHA5127f5c5bc5491b6959fca1c8c3a352d92bbd4974ecef20a7a429146702ffff9077df466aeaf6df13ed6cc758a8d2ed1436014a468f0cf40703999ccb7137710bdd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b