c94c74707711236f29723e101e332c35ea1c5148cd50ea869c37f5584b049d14

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 13:21 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fbd9d442d2872b76b8de392836750c8_JaffaCakes118.html
Size

71KB
MD5

6fbd9d442d2872b76b8de392836750c8
SHA1

6aeb86aa48062d5cbd4f088c84972b3067d605fc
SHA256

c94c74707711236f29723e101e332c35ea1c5148cd50ea869c37f5584b049d14
SHA512

1a356ad2cf6829501c332f4391792a6ae5b2b816a6e8c6e7af916c0b992cf3d0cadb389530178b812c64debc12a749c38c08e626451ec15acf08048837421c16
SSDEEP

768:Sr0hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/VV:SnIk/ntnwOHgHucp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
2596	msedge.exe
2596	msedge.exe
4312	identity_helper.exe
4312	identity_helper.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 3036	2596	msedge.exe	84
PID 2596 wrote to memory of 3036	2596	msedge.exe	84
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 1068	2596	msedge.exe	85
PID 2596 wrote to memory of 3532	2596	msedge.exe	86
PID 2596 wrote to memory of 3532	2596	msedge.exe	86
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87
PID 2596 wrote to memory of 4300	2596	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6fbd9d442d2872b76b8de392836750c8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafb2746f8,0x7ffafb274708,0x7ffafb274718
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,13395855969392078075,16493985943301619309,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

Network

DNS

roundassmounds.com

msedge.exe

Remote address:

8.8.8.8:53

Request

roundassmounds.com

IN A

Response
DNS

tracker.icerocket.com

msedge.exe

Remote address:

8.8.8.8:53

Request

tracker.icerocket.com

IN A

Response

tracker.icerocket.com

IN CNAME

www.icerocket.com

www.icerocket.com

IN CNAME

icerocket.com

icerocket.com

IN A

209.191.189.249
DNS

teensoftheweb.com

msedge.exe

Remote address:

8.8.8.8:53

Request

teensoftheweb.com

IN A

Response
GET

http://www.google-analytics.com/ga.js

msedge.exe

Remote address:

172.217.169.46:80

Request

GET /ga.js HTTP/1.1
Host: www.google-analytics.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Intervention: <https://permanently-removed.invalid/feature/5718547946799104>; level="warning"
DNT: 1
Accept: */*
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Cross-Origin-Resource-Policy: cross-origin
Server: Golfe2
Content-Length: 17168
Date: Thu, 25 Jul 2024 11:38:01 GMT
Expires: Thu, 25 Jul 2024 13:38:01 GMT
Cache-Control: public, max-age=7200
Age: 6290
Last-Modified: Tue, 12 Dec 2023 18:09:08 GMT
Content-Type: text/javascript
Vary: Accept-Encoding
DNS

71.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

71.159.190.20.in-addr.arpa

IN PTR

Response
DNS

209.205.72.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

209.205.72.20.in-addr.arpa

IN PTR

Response
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

46.169.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

46.169.217.172.in-addr.arpa

IN PTR

Response

46.169.217.172.in-addr.arpa

IN PTR

lhr48s08-in-f141e100net
DNS

58.99.105.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

58.99.105.20.in-addr.arpa

IN PTR

Response
DNS

149.220.183.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

149.220.183.52.in-addr.arpa

IN PTR

Response
DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

ccfelomvhk.com

msedge.exe

Remote address:

8.8.8.8:53

Request

ccfelomvhk.com

IN A

Response

ccfelomvhk.com

IN A

103.224.182.217
GET

http://ccfelomvhk.com/dl/adv542.php

msedge.exe

Remote address:

103.224.182.217:80

Request

GET /dl/adv542.php HTTP/1.1
Host: ccfelomvhk.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 302 Found

date: Thu, 25 Jul 2024 13:23:13 GMT
server: Apache
set-cookie: __tad=1721913793.7146252; expires=Sun, 23-Jul-2034 13:23:13 GMT; Max-Age=315360000
location: http://ww16.ccfelomvhk.com/dl/adv542.php?sub1=20240725-2323-13ee-b0dc-34ebb876f536
content-length: 2
content-type: text/html; charset=UTF-8
connection: close
GET

http://ccfelomvhk.com/dl/adv542.php

msedge.exe

Remote address:

103.224.182.217:80

Request

GET /dl/adv542.php HTTP/1.1
Host: ccfelomvhk.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 302 Found

date: Thu, 25 Jul 2024 13:23:13 GMT
server: Apache
set-cookie: __tad=1721913793.2858441; expires=Sun, 23-Jul-2034 13:23:13 GMT; Max-Age=315360000
location: http://ww16.ccfelomvhk.com/dl/adv542.php?sub1=20240725-2323-134c-9e74-85303a7acfa7
content-length: 2
content-type: text/html; charset=UTF-8
connection: close
DNS

ww16.ccfelomvhk.com

msedge.exe

Remote address:

8.8.8.8:53

Request

ww16.ccfelomvhk.com

IN A

Response

ww16.ccfelomvhk.com

IN CNAME

www.sedoparking.com

www.sedoparking.com

IN A

64.190.63.136
GET

http://ww16.ccfelomvhk.com/dl/adv542.php?sub1=20240725-2323-13ee-b0dc-34ebb876f536

msedge.exe

Remote address:

64.190.63.136:80

Request

GET /dl/adv542.php?sub1=20240725-2323-13ee-b0dc-34ebb876f536 HTTP/1.1
Host: ww16.ccfelomvhk.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

date: Thu, 25 Jul 2024 13:23:13 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
vary: Accept-Encoding
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_0Q+YQKcz7g0gsAJ9b4QPwXoWnhobua3sA7dpP+0NivtyNB6hM0P21BK0KIfUFvUU0w+WKDQ/Y3uF6FyzsCkTgg==
last-modified: Thu, 25 Jul 2024 13:23:13 GMT
x-cache-miss-from: parking-cf55897ff-zc27t
server: Parking/1.0
content-encoding: gzip
GET

http://ww16.ccfelomvhk.com/dl/adv542.php?sub1=20240725-2323-134c-9e74-85303a7acfa7

msedge.exe

Remote address:

64.190.63.136:80

Request

GET /dl/adv542.php?sub1=20240725-2323-134c-9e74-85303a7acfa7 HTTP/1.1
Host: ww16.ccfelomvhk.com
Connection: keep-alive
Upgrade-Insecure-Requests: 1
DNT: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

date: Thu, 25 Jul 2024 13:23:14 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
vary: Accept-Encoding
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_pboGN2zghjbP3UZ+oEOkmNRDFKZjSshUEKhYOrsFR8EI3KQHBqCCW3U4wb9Y6ngzy/vnyrtUkllwQjKB7sEmjw==
last-modified: Thu, 25 Jul 2024 13:23:14 GMT
x-cache-miss-from: parking-cf55897ff-8ddck
server: Parking/1.0
content-encoding: gzip
DNS

www.google.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.google.com

IN A

Response

www.google.com

IN A

142.250.187.228
DNS

www.sedo.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.sedo.com

IN A

Response

www.sedo.com

IN A

104.16.140.114

www.sedo.com

IN A

104.16.141.114
DNS

www.sedo.com

msedge.exe

Remote address:

8.8.8.8:53

Request

www.sedo.com

IN A
DNS

sedo.com

msedge.exe

Remote address:

8.8.8.8:53

Request

sedo.com

IN A

Response

sedo.com

IN A

104.16.140.114

sedo.com

IN A

104.16.141.114
DNS

sedo.com

msedge.exe

Remote address:

8.8.8.8:53

Request

sedo.com

IN A
GET

http://www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true

msedge.exe

Remote address:

142.250.187.228:80

Request

GET /adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true HTTP/1.1
Host: www.google.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Referer: http://ww16.ccfelomvhk.com/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Date: Thu, 25 Jul 2024 13:23:13 GMT
Expires: Thu, 25 Jul 2024 13:23:13 GMT
Cache-Control: private, max-age=3600
ETag: "15519479586284303111"
X-Content-Type-Options: nosniff
Link: <https://syndicatedsearch.goog>; rel="preconnect"
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: sffe
X-XSS-Protection: 0
DNS

136.63.190.64.in-addr.arpa

Remote address:

8.8.8.8:53

Request

136.63.190.64.in-addr.arpa

IN PTR

Response
DNS

217.182.224.103.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.182.224.103.in-addr.arpa

IN PTR

Response

217.182.224.103.in-addr.arpa

IN PTR

lb-182-217abovecom
DNS

syndicatedsearch.goog

msedge.exe

Remote address:

8.8.8.8:53

Request

syndicatedsearch.goog

IN A

Response

syndicatedsearch.goog

IN A

216.58.212.238
GET

https://syndicatedsearch.goog/afs/ads/i/iframe.html

msedge.exe

Remote address:

216.58.212.238:443

Request

GET /afs/ads/i/iframe.html HTTP/2.0
host: syndicatedsearch.goog
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://ww16.ccfelomvhk.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=7446205343&channel=cl-107%2Cexp-0014%2Cexp-0051%2Cauxa-control-1%2C13262&client=dp-sedo85_3ph&r=m&sc_status=0&hl=en&ivt=0&rpbu=http%3A%2F%2Fww16.ccfelomvhk.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjE5MTM3OTMmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzE4YzdlNDAuMjIwMTYyODgmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX&type=3&uiopt=false&swp=as-drid-2976593320017976&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436%2C17301490%2C17301492%2C17301495%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=5651721913792708&num=0&output=afd_ads&domain_name=ww16.ccfelomvhk.com&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1721913792722&u_w=1280&u_h=720&biw=-12245933&bih=-12245933&isw=0&ish=0&psw=0&psh=1542&frm=2&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww16.ccfelomvhk.com%2Fdl%2Fadv542.php%3Fsub1%3D20240725-2323-13ee-b0dc-34ebb876f536&lao=file%3A%2F%2F

msedge.exe

Remote address:

216.58.212.238:443

Request

GET /afs/ads?adsafe=low&adtest=off&psid=7446205343&channel=cl-107%2Cexp-0014%2Cexp-0051%2Cauxa-control-1%2C13262&client=dp-sedo85_3ph&r=m&sc_status=0&hl=en&ivt=0&rpbu=http%3A%2F%2Fww16.ccfelomvhk.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjE5MTM3OTMmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzE4YzdlNDAuMjIwMTYyODgmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX&type=3&uiopt=false&swp=as-drid-2976593320017976&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436%2C17301490%2C17301492%2C17301495%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=5651721913792708&num=0&output=afd_ads&domain_name=ww16.ccfelomvhk.com&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1721913792722&u_w=1280&u_h=720&biw=-12245933&bih=-12245933&isw=0&ish=0&psw=0&psh=1542&frm=2&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww16.ccfelomvhk.com%2Fdl%2Fadv542.php%3Fsub1%3D20240725-2323-13ee-b0dc-34ebb876f536&lao=file%3A%2F%2F HTTP/2.0
host: syndicatedsearch.goog
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://ww16.ccfelomvhk.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

https://syndicatedsearch.goog/afs/ads/i/iframe.html

msedge.exe

Remote address:

216.58.212.238:443

Request

GET /afs/ads/i/iframe.html HTTP/2.0
host: syndicatedsearch.goog
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://ww16.ccfelomvhk.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
if-modified-since: Tue, 12 Mar 2024 06:00:00 GMT
GET

https://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=7446205343&channel=cl-107%2Cexp-0014%2Cexp-0051%2Cauxa-control-1%2C13262&client=dp-sedo85_3ph&r=m&sc_status=0&hl=en&ivt=0&rpbu=http%3A%2F%2Fww16.ccfelomvhk.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjE5MTM3OTQmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzIxYTk3ODAuMTIwNjIzODEmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX&type=3&uiopt=false&swp=as-drid-2976593320017976&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436%2C17301490%2C17301492%2C17301495%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=6821721913792884&num=0&output=afd_ads&domain_name=ww16.ccfelomvhk.com&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1721913792895&u_w=1280&u_h=720&biw=-12245933&bih=-12245933&isw=0&ish=0&psw=0&psh=1542&frm=2&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww16.ccfelomvhk.com%2Fdl%2Fadv542.php%3Fsub1%3D20240725-2323-134c-9e74-85303a7acfa7&lao=file%3A%2F%2F

msedge.exe

Remote address:

216.58.212.238:443

Request

GET /afs/ads?adsafe=low&adtest=off&psid=7446205343&channel=cl-107%2Cexp-0014%2Cexp-0051%2Cauxa-control-1%2C13262&client=dp-sedo85_3ph&r=m&sc_status=0&hl=en&ivt=0&rpbu=http%3A%2F%2Fww16.ccfelomvhk.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjE5MTM3OTQmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzIxYTk3ODAuMTIwNjIzODEmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX&type=3&uiopt=false&swp=as-drid-2976593320017976&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436%2C17301490%2C17301492%2C17301495%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=6821721913792884&num=0&output=afd_ads&domain_name=ww16.ccfelomvhk.com&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1721913792895&u_w=1280&u_h=720&biw=-12245933&bih=-12245933&isw=0&ish=0&psw=0&psh=1542&frm=2&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww16.ccfelomvhk.com%2Fdl%2Fadv542.php%3Fsub1%3D20240725-2323-134c-9e74-85303a7acfa7&lao=file%3A%2F%2F HTTP/2.0
host: syndicatedsearch.goog
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: http://ww16.ccfelomvhk.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
GET

http://ww16.ccfelomvhk.com/search/tsc.php?200=MTMzMjc0MDI3&21=MTk0LjExMC4xMy43MA==&681=MTcyMTkxMzc5MzI2NmNiZjY1ZjAyNGJiNzkzMTFhZDg2YzY1Mjk3ODBk&crc=8290c5579cf62788714e847af7785d2a2e7f336f&cv=1

msedge.exe

Remote address:

64.190.63.136:80

Request

GET /search/tsc.php?200=MTMzMjc0MDI3&21=MTk0LjExMC4xMy43MA==&681=MTcyMTkxMzc5MzI2NmNiZjY1ZjAyNGJiNzkzMTFhZDg2YzY1Mjk3ODBk&crc=8290c5579cf62788714e847af7785d2a2e7f336f&cv=1 HTTP/1.1
Host: ww16.ccfelomvhk.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Referer: http://ww16.ccfelomvhk.com/dl/adv542.php?sub1=20240725-2323-13ee-b0dc-34ebb876f536
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

date: Thu, 25 Jul 2024 13:23:14 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-cache-miss-from: parking-cf55897ff-fmz8b
server: Parking/1.0
GET

http://ww16.ccfelomvhk.com/search/tsc.php?200=MTMzMjc0MDI3&21=MTk0LjExMC4xMy43MA==&681=MTcyMTkxMzc5NDUwNWQxZDMwY2U0NWRhZGVjMGNlMDg5YzllMGYwMTk5&crc=b8f8d2e3d5f52ba4a365b66edeb544df921d42d0&cv=1

msedge.exe

Remote address:

64.190.63.136:80

Request

GET /search/tsc.php?200=MTMzMjc0MDI3&21=MTk0LjExMC4xMy43MA==&681=MTcyMTkxMzc5NDUwNWQxZDMwY2U0NWRhZGVjMGNlMDg5YzllMGYwMTk5&crc=b8f8d2e3d5f52ba4a365b66edeb544df921d42d0&cv=1 HTTP/1.1
Host: ww16.ccfelomvhk.com
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: */*
Referer: http://ww16.ccfelomvhk.com/dl/adv542.php?sub1=20240725-2323-134c-9e74-85303a7acfa7
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Response

HTTP/1.1 200 OK

date: Thu, 25 Jul 2024 13:23:14 GMT
content-type: text/html; charset=UTF-8
content-length: 0
x-cache-miss-from: parking-cf55897ff-t25s8
server: Parking/1.0
GET

https://www.google.com/sorry/index?continue=https://syndicatedsearch.goog/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7446205343%26channel%3Dcl-107%252Cexp-0014%252Cexp-0051%252Cauxa-control-1%252C13262%26client%3Ddp-sedo85_3ph%26r%3Dm%26sc_status%3D0%26hl%3Den%26ivt%3D0%26rpbu%3Dhttp%253A%252F%252Fww16.ccfelomvhk.com%252Fcaf%252F%253Fses%253DY3JlPTE3MjE5MTM3OTMmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzE4YzdlNDAuMjIwMTYyODgmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX%26type%3D3%26uiopt%3Dfalse%26swp%3Das-drid-2976593320017976%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300003%252C17301431%252C17301433%252C17301436%252C17301490%252C17301492%252C17301495%252C17301511%252C17301516%252C17301266%26format%3Dr3%257Cs%26nocache%3D5651721913792708%26num%3D0%26output%3Dafd_ads%26domain_name%3Dww16.ccfelomvhk.com%26v%3D3%26bsl%3D8%26pac%3D0%26u_his%3D1%26u_tz%3D0%26dt%3D1721913792722%26u_w%3D1280%26u_h%3D720%26biw%3D-12245933%26bih%3D-12245933%26isw%3D0%26ish%3D0%26psw%3D0%26psh%3D1542%26frm%3D2%26uio%3D--%26cont%3Drb-default%26drt%3D0%26jsid%3Dcaf%26jsv%3D652824369%26rurl%3Dhttp%253A%252F%252Fww16.ccfelomvhk.com%252Fdl%252Fadv542.php%253Fsub1%253D20240725-2323-13ee-b0dc-34ebb876f536%26lao%3Dfile%253A%252F%252F&hl=en&q=EgTCbg1GGMKjibUGIjBCwfD_kqQTyOKbdjrpwP6--f8CyOYJxp9W3MehqEwOJzNDti1mSYfS10HmLhcVpBsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

msedge.exe

Remote address:

142.250.187.228:443

Request

GET /sorry/index?continue=https://syndicatedsearch.goog/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7446205343%26channel%3Dcl-107%252Cexp-0014%252Cexp-0051%252Cauxa-control-1%252C13262%26client%3Ddp-sedo85_3ph%26r%3Dm%26sc_status%3D0%26hl%3Den%26ivt%3D0%26rpbu%3Dhttp%253A%252F%252Fww16.ccfelomvhk.com%252Fcaf%252F%253Fses%253DY3JlPTE3MjE5MTM3OTMmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzE4YzdlNDAuMjIwMTYyODgmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX%26type%3D3%26uiopt%3Dfalse%26swp%3Das-drid-2976593320017976%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300003%252C17301431%252C17301433%252C17301436%252C17301490%252C17301492%252C17301495%252C17301511%252C17301516%252C17301266%26format%3Dr3%257Cs%26nocache%3D5651721913792708%26num%3D0%26output%3Dafd_ads%26domain_name%3Dww16.ccfelomvhk.com%26v%3D3%26bsl%3D8%26pac%3D0%26u_his%3D1%26u_tz%3D0%26dt%3D1721913792722%26u_w%3D1280%26u_h%3D720%26biw%3D-12245933%26bih%3D-12245933%26isw%3D0%26ish%3D0%26psw%3D0%26psh%3D1542%26frm%3D2%26uio%3D--%26cont%3Drb-default%26drt%3D0%26jsid%3Dcaf%26jsv%3D652824369%26rurl%3Dhttp%253A%252F%252Fww16.ccfelomvhk.com%252Fdl%252Fadv542.php%253Fsub1%253D20240725-2323-13ee-b0dc-34ebb876f536%26lao%3Dfile%253A%252F%252F&hl=en&q=EgTCbg1GGMKjibUGIjBCwfD_kqQTyOKbdjrpwP6--f8CyOYJxp9W3MehqEwOJzNDti1mSYfS10HmLhcVpBsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/2.0
host: www.google.com
upgrade-insecure-requests: 1
dnt: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
sec-ch-ua: "Chromium";v="92", " Not A;Brand";v="99", "Microsoft Edge";v="92"
sec-ch-ua-mobile: ?0
referer: http://ww16.ccfelomvhk.com/
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
DNS

228.187.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

228.187.250.142.in-addr.arpa

IN PTR

Response

228.187.250.142.in-addr.arpa

IN PTR

lhr25s34-in-f41e100net
DNS

238.212.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

238.212.58.216.in-addr.arpa

IN PTR

Response

238.212.58.216.in-addr.arpa

IN PTR

ams16s22-in-f141e100net

238.212.58.216.in-addr.arpa

IN PTR

lhr25s28-in-f14�I

238.212.58.216.in-addr.arpa

IN PTR

ams16s22-in-f238�I
DNS

195.212.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.212.58.216.in-addr.arpa

IN PTR

Response

195.212.58.216.in-addr.arpa

IN PTR

ams16s21-in-f31e100net

195.212.58.216.in-addr.arpa

IN PTR

ams16s21-in-f195�H

195.212.58.216.in-addr.arpa

IN PTR

lhr25s27-in-f3�H
DNS

227.16.217.172.in-addr.arpa

Remote address:

8.8.8.8:53

Request

227.16.217.172.in-addr.arpa

IN PTR

Response

227.16.217.172.in-addr.arpa

IN PTR

lhr48s28-in-f31e100net

227.16.217.172.in-addr.arpa

IN PTR

mad08s04-in-f3�H
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

171.39.242.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.39.242.20.in-addr.arpa

IN PTR

Response
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

ax-0001.ax-msedge.net

ax-0001.ax-msedge.net

IN A

150.171.28.10

ax-0001.ax-msedge.net

IN A

150.171.27.10
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301243_1NFMASG3SLY79TVLK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239317301243_1NFMASG3SLY79TVLK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 572083
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D3F93C31C9B440EEAC935F248F65541D Ref B: LON04EDGE0908 Ref C: 2024-07-25T13:23:27Z
date: Thu, 25 Jul 2024 13:23:27 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388045_10YSQ8K0BZLEAZQJ2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239339388045_10YSQ8K0BZLEAZQJ2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 432445
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 415453210D854E81BCF58A73A6B8F925 Ref B: LON04EDGE0908 Ref C: 2024-07-25T13:23:27Z
date: Thu, 25 Jul 2024 13:23:27 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239339388044_1386ER2SMV9FN565Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239339388044_1386ER2SMV9FN565Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 574268
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EBB6C39EE54C436697BF09E86BCB6370 Ref B: LON04EDGE0908 Ref C: 2024-07-25T13:23:27Z
date: Thu, 25 Jul 2024 13:23:27 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301652_1R39G8DVE3D1IPAHO&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239317301652_1R39G8DVE3D1IPAHO&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 599550
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F6A8CF42FD474CC4AF9009DDCBC5C28D Ref B: LON04EDGE0908 Ref C: 2024-07-25T13:23:27Z
date: Thu, 25 Jul 2024 13:23:27 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239355262897_1WRSJCEZM1EG3MR0G&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239355262897_1WRSJCEZM1EG3MR0G&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 1265436
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B78AD2E51E10492AAECC5D19B52CFC87 Ref B: LON04EDGE0908 Ref C: 2024-07-25T13:23:27Z
date: Thu, 25 Jul 2024 13:23:27 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239355262898_1GZLH62E7DDOB6LZ5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

150.171.28.10:443

Request

GET /th?id=OADD2.10239355262898_1GZLH62E7DDOB6LZ5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 1420323
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 741A82F0DEA44AC6817F9ED603BE9BAF Ref B: LON04EDGE0908 Ref C: 2024-07-25T13:23:28Z
date: Thu, 25 Jul 2024 13:23:28 GMT
DNS

43.58.199.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

43.58.199.20.in-addr.arpa

IN PTR

Response
DNS

161.114.50.184.in-addr.arpa

Remote address:

8.8.8.8:53

Request

161.114.50.184.in-addr.arpa

IN PTR

Response

161.114.50.184.in-addr.arpa

IN PTR

a184-50-114-161deploystaticakamaitechnologiescom
DNS

14.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.227.111.52.in-addr.arpa

IN PTR

Response

209.191.189.249:80

tracker.icerocket.com

msedge.exe

260 B
5
209.191.189.249:80

tracker.icerocket.com

msedge.exe

260 B
5
172.217.169.46:80

http://www.google-analytics.com/ga.js

http

msedge.exe

1.0kB
18.4kB
13
18

HTTP Request

GET http://www.google-analytics.com/ga.js

HTTP Response

200
209.191.189.249:80

tracker.icerocket.com

msedge.exe

260 B
5
103.224.182.217:80

http://ccfelomvhk.com/dl/adv542.php

http

msedge.exe

689 B
517 B
5
4

HTTP Request

GET http://ccfelomvhk.com/dl/adv542.php

HTTP Response

302
103.224.182.217:80

http://ccfelomvhk.com/dl/adv542.php

http

msedge.exe

735 B
517 B
6
4

HTTP Request

GET http://ccfelomvhk.com/dl/adv542.php

HTTP Response

302
64.190.63.136:80

http://ww16.ccfelomvhk.com/dl/adv542.php?sub1=20240725-2323-134c-9e74-85303a7acfa7

http

msedge.exe

2.2kB
17.5kB
15
19

HTTP Request

GET http://ww16.ccfelomvhk.com/dl/adv542.php?sub1=20240725-2323-13ee-b0dc-34ebb876f536

HTTP Response

200

HTTP Request

GET http://ww16.ccfelomvhk.com/dl/adv542.php?sub1=20240725-2323-134c-9e74-85303a7acfa7

HTTP Response

200
142.250.187.228:80

http://www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true

http

msedge.exe

2.0kB
80.8kB
35
63

HTTP Request

GET http://www.google.com/adsense/domains/caf.js?abp=1&YEr3CiF6AuQqLspNobyal3ji0SyqxBLn=true

HTTP Response

200
216.58.212.238:443

https://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=7446205343&channel=cl-107%2Cexp-0014%2Cexp-0051%2Cauxa-control-1%2C13262&client=dp-sedo85_3ph&r=m&sc_status=0&hl=en&ivt=0&rpbu=http%3A%2F%2Fww16.ccfelomvhk.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjE5MTM3OTQmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzIxYTk3ODAuMTIwNjIzODEmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX&type=3&uiopt=false&swp=as-drid-2976593320017976&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436%2C17301490%2C17301492%2C17301495%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=6821721913792884&num=0&output=afd_ads&domain_name=ww16.ccfelomvhk.com&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1721913792895&u_w=1280&u_h=720&biw=-12245933&bih=-12245933&isw=0&ish=0&psw=0&psh=1542&frm=2&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww16.ccfelomvhk.com%2Fdl%2Fadv542.php%3Fsub1%3D20240725-2323-134c-9e74-85303a7acfa7&lao=file%3A%2F%2F

tls, http2

msedge.exe

4.5kB
15.3kB
31
35

HTTP Request

GET https://syndicatedsearch.goog/afs/ads/i/iframe.html

HTTP Request

GET https://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=7446205343&channel=cl-107%2Cexp-0014%2Cexp-0051%2Cauxa-control-1%2C13262&client=dp-sedo85_3ph&r=m&sc_status=0&hl=en&ivt=0&rpbu=http%3A%2F%2Fww16.ccfelomvhk.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjE5MTM3OTMmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzE4YzdlNDAuMjIwMTYyODgmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX&type=3&uiopt=false&swp=as-drid-2976593320017976&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436%2C17301490%2C17301492%2C17301495%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=5651721913792708&num=0&output=afd_ads&domain_name=ww16.ccfelomvhk.com&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1721913792722&u_w=1280&u_h=720&biw=-12245933&bih=-12245933&isw=0&ish=0&psw=0&psh=1542&frm=2&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww16.ccfelomvhk.com%2Fdl%2Fadv542.php%3Fsub1%3D20240725-2323-13ee-b0dc-34ebb876f536&lao=file%3A%2F%2F

HTTP Request

GET https://syndicatedsearch.goog/afs/ads/i/iframe.html

HTTP Request

GET https://syndicatedsearch.goog/afs/ads?adsafe=low&adtest=off&psid=7446205343&channel=cl-107%2Cexp-0014%2Cexp-0051%2Cauxa-control-1%2C13262&client=dp-sedo85_3ph&r=m&sc_status=0&hl=en&ivt=0&rpbu=http%3A%2F%2Fww16.ccfelomvhk.com%2Fcaf%2F%3Fses%3DY3JlPTE3MjE5MTM3OTQmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzIxYTk3ODAuMTIwNjIzODEmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX&type=3&uiopt=false&swp=as-drid-2976593320017976&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300003%2C17301431%2C17301433%2C17301436%2C17301490%2C17301492%2C17301495%2C17301511%2C17301516%2C17301266&format=r3%7Cs&nocache=6821721913792884&num=0&output=afd_ads&domain_name=ww16.ccfelomvhk.com&v=3&bsl=8&pac=0&u_his=1&u_tz=0&dt=1721913792895&u_w=1280&u_h=720&biw=-12245933&bih=-12245933&isw=0&ish=0&psw=0&psh=1542&frm=2&uio=--&cont=rb-default&drt=0&jsid=caf&jsv=652824369&rurl=http%3A%2F%2Fww16.ccfelomvhk.com%2Fdl%2Fadv542.php%3Fsub1%3D20240725-2323-134c-9e74-85303a7acfa7&lao=file%3A%2F%2F
64.190.63.136:80

http://ww16.ccfelomvhk.com/search/tsc.php?200=MTMzMjc0MDI3&21=MTk0LjExMC4xMy43MA==&681=MTcyMTkxMzc5NDUwNWQxZDMwY2U0NWRhZGVjMGNlMDg5YzllMGYwMTk5&crc=b8f8d2e3d5f52ba4a365b66edeb544df921d42d0&cv=1

http

msedge.exe

1.4kB
568 B
7
5

HTTP Request

GET http://ww16.ccfelomvhk.com/search/tsc.php?200=MTMzMjc0MDI3&21=MTk0LjExMC4xMy43MA==&681=MTcyMTkxMzc5MzI2NmNiZjY1ZjAyNGJiNzkzMTFhZDg2YzY1Mjk3ODBk&crc=8290c5579cf62788714e847af7785d2a2e7f336f&cv=1

HTTP Response

200

HTTP Request

GET http://ww16.ccfelomvhk.com/search/tsc.php?200=MTMzMjc0MDI3&21=MTk0LjExMC4xMy43MA==&681=MTcyMTkxMzc5NDUwNWQxZDMwY2U0NWRhZGVjMGNlMDg5YzllMGYwMTk5&crc=b8f8d2e3d5f52ba4a365b66edeb544df921d42d0&cv=1

HTTP Response

200
142.250.187.228:443

https://www.google.com/sorry/index?continue=https://syndicatedsearch.goog/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7446205343%26channel%3Dcl-107%252Cexp-0014%252Cexp-0051%252Cauxa-control-1%252C13262%26client%3Ddp-sedo85_3ph%26r%3Dm%26sc_status%3D0%26hl%3Den%26ivt%3D0%26rpbu%3Dhttp%253A%252F%252Fww16.ccfelomvhk.com%252Fcaf%252F%253Fses%253DY3JlPTE3MjE5MTM3OTMmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzE4YzdlNDAuMjIwMTYyODgmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX%26type%3D3%26uiopt%3Dfalse%26swp%3Das-drid-2976593320017976%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300003%252C17301431%252C17301433%252C17301436%252C17301490%252C17301492%252C17301495%252C17301511%252C17301516%252C17301266%26format%3Dr3%257Cs%26nocache%3D5651721913792708%26num%3D0%26output%3Dafd_ads%26domain_name%3Dww16.ccfelomvhk.com%26v%3D3%26bsl%3D8%26pac%3D0%26u_his%3D1%26u_tz%3D0%26dt%3D1721913792722%26u_w%3D1280%26u_h%3D720%26biw%3D-12245933%26bih%3D-12245933%26isw%3D0%26ish%3D0%26psw%3D0%26psh%3D1542%26frm%3D2%26uio%3D--%26cont%3Drb-default%26drt%3D0%26jsid%3Dcaf%26jsv%3D652824369%26rurl%3Dhttp%253A%252F%252Fww16.ccfelomvhk.com%252Fdl%252Fadv542.php%253Fsub1%253D20240725-2323-13ee-b0dc-34ebb876f536%26lao%3Dfile%253A%252F%252F&hl=en&q=EgTCbg1GGMKjibUGIjBCwfD_kqQTyOKbdjrpwP6--f8CyOYJxp9W3MehqEwOJzNDti1mSYfS10HmLhcVpBsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM

tls, http2

msedge.exe

3.1kB
13.0kB
19
20

HTTP Request

GET https://www.google.com/sorry/index?continue=https://syndicatedsearch.goog/afs/ads%3Fadsafe%3Dlow%26adtest%3Doff%26psid%3D7446205343%26channel%3Dcl-107%252Cexp-0014%252Cexp-0051%252Cauxa-control-1%252C13262%26client%3Ddp-sedo85_3ph%26r%3Dm%26sc_status%3D0%26hl%3Den%26ivt%3D0%26rpbu%3Dhttp%253A%252F%252Fww16.ccfelomvhk.com%252Fcaf%252F%253Fses%253DY3JlPTE3MjE5MTM3OTMmdGNpZD13dzE2LmNjZmVsb212aGsuY29tNjZhMjUxYzE4YzdlNDAuMjIwMTYyODgmdGFzaz1zZWFyY2gmZG9tYWluPWNjZmVsb212aGsuY29tJmFfaWQ9MyZzZXNzaW9uPTFFbl9nTkx5amtJVUtrZHJGMkxX%26type%3D3%26uiopt%3Dfalse%26swp%3Das-drid-2976593320017976%26oe%3DUTF-8%26ie%3DUTF-8%26fexp%3D21404%252C17300003%252C17301431%252C17301433%252C17301436%252C17301490%252C17301492%252C17301495%252C17301511%252C17301516%252C17301266%26format%3Dr3%257Cs%26nocache%3D5651721913792708%26num%3D0%26output%3Dafd_ads%26domain_name%3Dww16.ccfelomvhk.com%26v%3D3%26bsl%3D8%26pac%3D0%26u_his%3D1%26u_tz%3D0%26dt%3D1721913792722%26u_w%3D1280%26u_h%3D720%26biw%3D-12245933%26bih%3D-12245933%26isw%3D0%26ish%3D0%26psw%3D0%26psh%3D1542%26frm%3D2%26uio%3D--%26cont%3Drb-default%26drt%3D0%26jsid%3Dcaf%26jsv%3D652824369%26rurl%3Dhttp%253A%252F%252Fww16.ccfelomvhk.com%252Fdl%252Fadv542.php%253Fsub1%253D20240725-2323-13ee-b0dc-34ebb876f536%26lao%3Dfile%253A%252F%252F&hl=en&q=EgTCbg1GGMKjibUGIjBCwfD_kqQTyOKbdjrpwP6--f8CyOYJxp9W3MehqEwOJzNDti1mSYfS10HmLhcVpBsyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13
150.171.28.10:443

tse1.mm.bing.net

tls, http2

1.2kB
6.9kB
15
13
150.171.28.10:443

https://tse1.mm.bing.net/th?id=OADD2.10239355262898_1GZLH62E7DDOB6LZ5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

tls, http2

183.2kB
5.0MB
3651
3644

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301243_1NFMASG3SLY79TVLK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388045_10YSQ8K0BZLEAZQJ2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239339388044_1386ER2SMV9FN565Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301652_1R39G8DVE3D1IPAHO&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239355262897_1WRSJCEZM1EG3MR0G&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239355262898_1GZLH62E7DDOB6LZ5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200

8.8.8.8:53

roundassmounds.com

dns

msedge.exe

64 B
137 B
1
1

DNS Request

roundassmounds.com
8.8.8.8:53

tracker.icerocket.com

dns

msedge.exe

67 B
115 B
1
1

DNS Request

tracker.icerocket.com

DNS Response

209.191.189.249
8.8.8.8:53

teensoftheweb.com

dns

msedge.exe

63 B
136 B
1
1

DNS Request

teensoftheweb.com
8.8.8.8:53

71.159.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

71.159.190.20.in-addr.arpa
8.8.8.8:53

209.205.72.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

209.205.72.20.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

46.169.217.172.in-addr.arpa

dns

73 B
112 B
1
1

DNS Request

46.169.217.172.in-addr.arpa
8.8.8.8:53

58.99.105.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

58.99.105.20.in-addr.arpa
224.0.0.251:5353

msedge.exe

516 B
8
8.8.8.8:53

149.220.183.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

149.220.183.52.in-addr.arpa
8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

ccfelomvhk.com

dns

msedge.exe

60 B
76 B
1
1

DNS Request

ccfelomvhk.com

DNS Response

103.224.182.217
8.8.8.8:53

ww16.ccfelomvhk.com

dns

msedge.exe

65 B
111 B
1
1

DNS Request

ww16.ccfelomvhk.com

DNS Response

64.190.63.136
8.8.8.8:53

www.google.com

dns

msedge.exe

60 B
76 B
1
1

DNS Request

www.google.com

DNS Response

142.250.187.228
8.8.8.8:53

www.sedo.com

dns

msedge.exe

116 B
90 B
2
1

DNS Request

www.sedo.com

DNS Request

www.sedo.com

DNS Response

104.16.140.114

104.16.141.114
8.8.8.8:53

sedo.com

dns

msedge.exe

108 B
86 B
2
1

DNS Request

sedo.com

DNS Request

sedo.com

DNS Response

104.16.140.114

104.16.141.114
8.8.8.8:53

136.63.190.64.in-addr.arpa

dns

72 B
156 B
1
1

DNS Request

136.63.190.64.in-addr.arpa
8.8.8.8:53

217.182.224.103.in-addr.arpa

dns

74 B
108 B
1
1

DNS Request

217.182.224.103.in-addr.arpa
8.8.8.8:53

syndicatedsearch.goog

dns

msedge.exe

67 B
83 B
1
1

DNS Request

syndicatedsearch.goog

DNS Response

216.58.212.238
216.58.212.238:443

syndicatedsearch.goog

https

msedge.exe

3.1kB
6.4kB
5
7
142.250.187.228:443

www.google.com

https

msedge.exe

9.9kB
77.8kB
53
79
142.250.187.228:443

www.google.com

https

msedge.exe

5.7kB
22.8kB
16
23
8.8.8.8:53

228.187.250.142.in-addr.arpa

dns

74 B
112 B
1
1

DNS Request

228.187.250.142.in-addr.arpa
8.8.8.8:53

238.212.58.216.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

238.212.58.216.in-addr.arpa
8.8.8.8:53

195.212.58.216.in-addr.arpa

dns

73 B
171 B
1
1

DNS Request

195.212.58.216.in-addr.arpa
8.8.8.8:53

227.16.217.172.in-addr.arpa

dns

73 B
140 B
1
1

DNS Request

227.16.217.172.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

171.39.242.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

171.39.242.20.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
170 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

150.171.28.10

150.171.27.10
8.8.8.8:53

43.58.199.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

43.58.199.20.in-addr.arpa
8.8.8.8:53

161.114.50.184.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

161.114.50.184.in-addr.arpa
8.8.8.8:53

14.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
210KB

MD5
5ac828ee8e3812a5b225161caf6c61da

SHA1
86e65f22356c55c21147ce97903f5dbdf363649f

SHA256
b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

SHA512
87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
9343bcf84524d74401c92dddd5576c58

SHA1
b6dc3a9786cf746fe224354e0d50c24959b3946b

SHA256
7a56bcd3b11ea9046107c130fb3799e98553b994131c3acd4f5881d0a04dabf8

SHA512
14ba69ed3e769117b882477670c74db99fac5fab040de48f9d791d6c417692acb8940315ab78880754bfed053478806909f33b92077997ea50958523757b6ad4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
812460d0c64b48155d63ee3c656b1921

SHA1
f8bc27ba6b331b1ef6b4cc6103ef193c2c3cc4a3

SHA256
36b2687ae95d01b262be1cb0fd01b223ef71d3747a3adc1094e5c9254f1f4678

SHA512
3177af1b8580ff9dd99f08e4fcf9956fd7b23c75337bdfc44df5602fadd70b3a134089aa5b0b799d1fe8df8c18eca5be133271e605ae6bf6485c3deecd9f3d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c918f85e134573e44c4e07d4ca6e46b1

SHA1
baa99784c67c7ef9b71b29a95f420d82c7e9dbe6

SHA256
eeab7e012d34b1c096162069ee24a02924649a3a02e237a9275199b3f77ac31c

SHA512
a527d9206db1f03eb2601372bf72e300bd785e92025c56c92ce0392f1b33b751fd591b2d7119fb1c53a8d676b088d31efd364ffde0f668c9a7d2d46865b6ab23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
685ed2ca189aa384f6f6ad9842144a29

SHA1
132995f6d9c4034a90cc329d7473c085ab0d7cfe

SHA256
cc903ee82efc2c921c81f74517cf995cbb6234cf243576529ee6f07f4469f0d2

SHA512
b94979e30da18955dc3b2f60d510e690aac0d6788bb758beb991b244688892adab9b4e70c97846d1d1b9383eff63fd14ba0c9b21ed82fd0a88fb7f85d968a745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
667e9f256b52341ff0332cc7efd9f55a

SHA1
3ad893035103b157c7fc89440e5deca74d117d72

SHA256
7560baf43aa1b4258f043ef363b1828e83ec722c3404e871e0a8f53bd4c171ed

SHA512
9cab0d2f32693c6e3b79abddcff0c8f840399f9cd3cdcc48da515af09f86a07d0df65d5f2f74136abe98c0338eb9bffb414d37e5c2d5c0c37224dbefe29c050f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
21f8bb8c792d8d10fbcd24c7a714b14d

SHA1
f37991af18120bc08ae71fb0e1aaa89555097d64

SHA256
0c679550fc11dd9c149c4fe7a053501f547d89e6b71721db9c0239506a896e2f

SHA512
232876137ebc4b574c2b3db0f0e76086bcad685c9ea453ce6dd8c868020f0670392281f5d7e9a7838516467f4bbdc8dafd467fc8a0662cf9fe0a061d9e3315bf

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor