Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
71s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16/09/2024, 15:21 UTC
General
-
Target
e50be41d01aff61dc9d6779e9af971ee_JaffaCakes118.exe
-
Size
7.3MB
-
MD5
e50be41d01aff61dc9d6779e9af971ee
-
SHA1
37b2431609aa7fd4f5f1411a42d2ad01fee94315
-
SHA256
fd1a09cae9282b6c05cc197be7d9a85f63d284a937ca581a257a4fab12631339
-
SHA512
b951bb2a59c8df6bed7c75060c506dcbe7df60127598f8c2bf7ba75cee3919adc68bdaf7c90fdcc71e05bfa580bc776f285a1cb24070d9a502f1e3776ec07ccb
-
SSDEEP
196608:YLZLgaILbuQPGRCd6y/yg37h25dFzl7LDJ:ELgaUyQOgdv/J37hwdFzl7J
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 7 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Program Files directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 12 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 21 IoCs
-
Suspicious use of WriteProcessMemory 37 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e50be41d01aff61dc9d6779e9af971ee_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e50be41d01aff61dc9d6779e9af971ee_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\Vaya Con Dios - Don't Cry For Louie.exe"C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\Vaya Con Dios - Don't Cry For Louie.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\ic4.exe"C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\ic4.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\2 Gansta.exe"C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\2 Gansta.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\2GANST~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\3R2R.exe"C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\3R2R.exe"2⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\3R2R.exeC:\Users\Admin\AppData\Local\Temp\nstA829.tmp\3R2R.exe startC:\Users\Admin\AppData\Roaming\C2A40\516C8.exe%C:\Users\Admin\AppData\Roaming\C2A403⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\3R2R.exeC:\Users\Admin\AppData\Local\Temp\nstA829.tmp\3R2R.exe startC:\Program Files (x86)\408FC\lvvm.exe%C:\Program Files (x86)\408FC3⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\LP\C8AC\25F2.tmp"C:\Program Files (x86)\LP\C8AC\25F2.tmp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\4tbp.exe"C:\Users\Admin\AppData\Local\Temp\nstA829.tmp\4tbp.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Wwrerma2.dll",Startup3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Wwrerma2.dll",iep4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
Network
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse -
DNS25.140.123.92.in-addr.arpaRemote address:8.8.8.8:53Request25.140.123.92.in-addr.arpaIN PTRResponse25.140.123.92.in-addr.arpaIN PTRa92-123-140-25deploystaticakamaitechnologiescom
-
DNS71.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request71.31.126.40.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNSaahacker.comRemote address:8.8.8.8:53Requestaahacker.comIN AResponse
-
DNSbascheme.comRemote address:8.8.8.8:53Requestbascheme.comIN AResponse
-
DNSevcs-ocsp.ws.symantec.comRemote address:8.8.8.8:53Requestevcs-ocsp.ws.symantec.comIN AResponseevcs-ocsp.ws.symantec.comIN CNAMEmpki-ocsp.digicert.commpki-ocsp.digicert.comIN CNAMEfp3011.wpc.2be4.phicdn.netfp3011.wpc.2be4.phicdn.netIN CNAMEfp3011.wpc.phicdn.netfp3011.wpc.phicdn.netIN A152.199.19.74
-
GEThttp://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DRemote address:152.199.19.74:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: evcs-ocsp.ws.symantec.com
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4621
Cache-Control: public, max-age=300
Content-Type: application/ocsp-response
Date: Mon, 16 Sep 2024 15:21:11 GMT
Last-Modified: Mon, 16 Sep 2024 14:04:10 GMT
Server: ECAcc (lhc/7916)
X-Cache: HIT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 5
-
GEThttp://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DRemote address:152.199.19.74:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3D HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: evcs-ocsp.ws.symantec.com
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4621
Cache-Control: public, max-age=300
Content-Type: application/ocsp-response
Date: Mon, 16 Sep 2024 15:21:11 GMT
Last-Modified: Mon, 16 Sep 2024 14:04:10 GMT
Server: ECAcc (lhc/7916)
X-Cache: HIT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 5
-
DNSevcs-crl.ws.symantec.comRemote address:8.8.8.8:53Requestevcs-crl.ws.symantec.comIN AResponseevcs-crl.ws.symantec.comIN CNAMEcrl-symcprod.digicert.comcrl-symcprod.digicert.comIN CNAMEcrl.edge.digicert.comcrl.edge.digicert.comIN CNAMEfp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.2be4.phicdn.netIN CNAMEfp2e7a.wpc.phicdn.netfp2e7a.wpc.phicdn.netIN A192.229.221.95
-
DNS74.19.199.152.in-addr.arpaRemote address:8.8.8.8:53Request74.19.199.152.in-addr.arpaIN PTRResponse
-
GEThttp://evcs-crl.ws.symantec.com/evcs.crlRemote address:192.229.221.95:80RequestGET /evcs.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: evcs-crl.ws.symantec.com
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 4499
Cache-Control: public, max-age=3600
Content-Type: application/pkix-crl
Date: Mon, 16 Sep 2024 15:21:11 GMT
Last-Modified: Mon, 16 Sep 2024 14:06:12 GMT
Server: ECAcc (lhd/35B2)
X-Cache: HIT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 2034
-
DNSbattleon.comRemote address:8.8.8.8:53Requestbattleon.comIN AResponsebattleon.comIN A104.26.11.172battleon.comIN A172.67.68.171battleon.comIN A104.26.10.172
-
GEThttp://battleon.com/134.gif?pr=gJ4WK%2FSUh7TFlUR8oY%2BQtMWTUj26kJH7yZJSNLqVybhqtUn5CGFATA%3D%3DRemote address:104.26.11.172:80RequestGET /134.gif?pr=gJ4WK%2FSUh7TFlUR8oY%2BQtMWTUj26kJH7yZJSNLqVybhqtUn5CGFATA%3D%3D HTTP/1.0
Connection: close
Host: battleon.com
Accept: */*
User-Agent: chrome/9.0
ResponseHTTP/1.1 301 Moved Permanently
Date: Mon, 16 Sep 2024 15:21:13 GMT
Content-Type: text/html
Content-Length: 167
Connection: close
Cache-Control: max-age=3600
Expires: Mon, 16 Sep 2024 16:21:13 GMT
Location: https://battleon.com/134.gif?pr=gJ4WK%2FSUh7TFlUR8oY%2BQtMWTUj26kJH7yZJSNLqVybhqtUn5CGFATA%3D%3D
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gqt5Gz%2BUpbGueI88chICpyYnNfzPZPTFaLz8egjOsK6B%2F9nzKPqh6OABRyB6Q8OjKOJBeyw2WX6Fwblq3oGEee5wVweTw5lKNyFajX%2BFlrhgJWT%2BpcoPJHQM3hHTfQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 8c41d851189463cf-LHR
-
DNS172.11.26.104.in-addr.arpaRemote address:8.8.8.8:53Request172.11.26.104.in-addr.arpaIN PTRResponse
-
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNSstoretabletpcforme.comRemote address:8.8.8.8:53Requeststoretabletpcforme.comIN AResponse
-
DNSourthreedomains.comRemote address:8.8.8.8:53Requestourthreedomains.comIN AResponse
-
DNS86.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNSstoretabletpcforme.comRemote address:8.8.8.8:53Requeststoretabletpcforme.comIN AResponse
-
DNSourdatatransfers.comRemote address:8.8.8.8:53Requestourdatatransfers.comIN AResponse
-
DNS18.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
GEThttp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3DRemote address:192.229.221.95:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D HTTP/1.1
Connection: close
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: ocsp.digicert.com
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 1890
Cache-Control: max-age=7200
Content-Type: application/ocsp-response
Date: Mon, 16 Sep 2024 15:21:40 GMT
Last-Modified: Mon, 16 Sep 2024 14:50:10 GMT
Server: ECAcc (lhd/35A8)
X-Cache: HIT
Content-Length: 471
Connection: close
-
DNS151607e80915.edataupdate.netRemote address:8.8.8.8:53Request151607e80915.edataupdate.netIN AResponse
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 838075
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F4A20E7308F34AF68B4BD4CD264F69F1 Ref B: LON04EDGE0709 Ref C: 2024-09-16T15:22:15Z
date: Mon, 16 Sep 2024 15:22:14 GMT
-
DNS151607e80915.edataupdate.netRemote address:8.8.8.8:53Request151607e80915.edataupdate.netIN AResponse
-
DNS151607e80915.edataupdate.netRemote address:8.8.8.8:53Request151607e80915.edataupdate.netIN AResponse
-
DNS240.143.123.92.in-addr.arpaRemote address:8.8.8.8:53Request240.143.123.92.in-addr.arpaIN PTRResponse240.143.123.92.in-addr.arpaIN PTRa92-123-143-240deploystaticakamaitechnologiescom
-
DNSwww.google.comRemote address:8.8.8.8:53Requestwww.google.comIN AResponsewww.google.comIN A142.250.178.4
-
GEThttp://www.google.com/Remote address:142.250.178.4:80RequestGET / HTTP/1.0
Connection: close
Host: www.google.com
Accept: */*
ResponseHTTP/1.0 302 Found
Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgTCbg1GGKWaobcGIjA9aWuEUOMREwTQgIEmYofkgVa62thvKKeQqRe2G8uQuyE4TpTLQ2sVQLpgNRnTAB4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
x-hallmonitor-challenge: CgwIpZqhtwYQzZPsowISBMJuDUY
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-uvM2PGJh-lHJm3Oz55-t_w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Date: Mon, 16 Sep 2024 15:22:13 GMT
Server: gws
Content-Length: 396
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7cokBhuE22Nyn6p6Pv_sybv61s9sgj7QrbWY1z4CUH2BgNADc6Ihlg; expires=Sat, 15-Mar-2025 15:22:13 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
-
GEThttp://www.google.com/Remote address:142.250.178.4:80RequestGET / HTTP/1.1
Connection: close
Pragma: no-cache
Host: www.google.com
ResponseHTTP/1.1 302 Found
Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgTCbg1GGKWaobcGIjA9aWuEUOMREwTQgIEmYofkgVa62thvKKeQqRe2G8uQuyE4TpTLQ2sVQLpgNRnTAB4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
x-hallmonitor-challenge: CgsIppqhtwYQ-ZXuMRIEwm4NRg
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-13ylLXV_ueYYxJDWNxIqyQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Date: Mon, 16 Sep 2024 15:22:14 GMT
Server: gws
Content-Length: 396
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVYB7cpZg3xo8Plq1yXfQGwDUZ5M--_bbFQYh2wfl_XnvCGbe1Yf7Z3yXw; expires=Sat, 15-Mar-2025 15:22:14 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Connection: close
-
DNS4.178.250.142.in-addr.arpaRemote address:8.8.8.8:53Request4.178.250.142.in-addr.arpaIN PTRResponse4.178.250.142.in-addr.arpaIN PTRlhr48s27-in-f41e100net
-
GEThttp://www.google.com/sorry/index?continue=http://www.google.com/&q=EgTCbg1GGKWaobcGIjA9aWuEUOMREwTQgIEmYofkgVa62thvKKeQqRe2G8uQuyE4TpTLQ2sVQLpgNRnTAB4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMRemote address:142.250.178.4:80RequestGET /sorry/index?continue=http://www.google.com/&q=EgTCbg1GGKWaobcGIjA9aWuEUOMREwTQgIEmYofkgVa62thvKKeQqRe2G8uQuyE4TpTLQ2sVQLpgNRnTAB4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1
Connection: close
Pragma: no-cache
Host: www.google.com
ResponseHTTP/1.1 429 Too Many Requests
Date: Mon, 16 Sep 2024 15:22:14 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3052
X-XSS-Protection: 0
Connection: close
-
DNS151607e80915.edataupdate.netRemote address:8.8.8.8:53Request151607e80915.edataupdate.netIN AResponse
-
DNS31.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
DNS151607e80915.edataupdate.netRemote address:8.8.8.8:53Request151607e80915.edataupdate.netIN AResponse
-
152.199.19.74:80http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3Dhttp
HTTP Request
GET http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DHTTP Response
200HTTP Request
GET http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DHTTP Response
200 -
192.229.221.95:80http://evcs-crl.ws.symantec.com/evcs.crlhttp
HTTP Request
GET http://evcs-crl.ws.symantec.com/evcs.crlHTTP Response
200 -
127.0.0.1:80 -
127.0.0.1:80
-
104.26.11.172:80http://battleon.com/134.gif?pr=gJ4WK%2FSUh7TFlUR8oY%2BQtMWTUj26kJH7yZJSNLqVybhqtUn5CGFATA%3D%3Dhttp
HTTP Request
GET http://battleon.com/134.gif?pr=gJ4WK%2FSUh7TFlUR8oY%2BQtMWTUj26kJH7yZJSNLqVybhqtUn5CGFATA%3D%3DHTTP Response
301 -
127.0.0.1:59717
-
192.229.221.95:80http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3Dhttp
HTTP Request
GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3DHTTP Response
200 -
150.171.27.10:443https://tse1.mm.bing.net/th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200 -
127.0.0.1:59717
-
127.0.0.1:59717
-
142.250.178.4:80http://www.google.com/http
HTTP Request
GET http://www.google.com/HTTP Response
302 -
142.250.178.4:80http://www.google.com/http
HTTP Request
GET http://www.google.com/HTTP Response
302 -
142.250.178.4:80http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgTCbg1GGKWaobcGIjA9aWuEUOMREwTQgIEmYofkgVa62thvKKeQqRe2G8uQuyE4TpTLQ2sVQLpgNRnTAB4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMhttp
HTTP Request
GET http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgTCbg1GGKWaobcGIjA9aWuEUOMREwTQgIEmYofkgVa62thvKKeQqRe2G8uQuyE4TpTLQ2sVQLpgNRnTAB4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMHTTP Response
429 -
127.0.0.1:59717
-
127.0.0.1:59717
-
127.0.0.1:59717
-
127.0.0.1:59717
-
127.0.0.1:59717
-
127.0.0.1:59717
-
127.0.0.1:59717
-
127.0.0.1:59717
-
127.0.0.1:59717
-
127.0.0.1:59717
-
8.8.8.8:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
-
8.8.8.8:5325.140.123.92.in-addr.arpadns
DNS Request
25.140.123.92.in-addr.arpa
-
8.8.8.8:5371.31.126.40.in-addr.arpadns
DNS Request
71.31.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53aahacker.comdns
DNS Request
aahacker.com
-
8.8.8.8:53bascheme.comdns
DNS Request
bascheme.com
-
8.8.8.8:53evcs-ocsp.ws.symantec.comdns
DNS Request
evcs-ocsp.ws.symantec.com
DNS Response
152.199.19.74
-
8.8.8.8:53evcs-crl.ws.symantec.comdns
DNS Request
evcs-crl.ws.symantec.com
DNS Response
192.229.221.95
-
8.8.8.8:5374.19.199.152.in-addr.arpadns
DNS Request
74.19.199.152.in-addr.arpa
-
8.8.8.8:53battleon.comdns
DNS Request
battleon.com
DNS Response
104.26.11.172172.67.68.171104.26.10.172
-
8.8.8.8:53172.11.26.104.in-addr.arpadns
DNS Request
172.11.26.104.in-addr.arpa
-
224.0.0.251:5353
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:53storetabletpcforme.comdns
DNS Request
storetabletpcforme.com
-
8.8.8.8:53ourthreedomains.comdns
DNS Request
ourthreedomains.com
-
8.8.8.8:5386.23.85.13.in-addr.arpadns
DNS Request
86.23.85.13.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:53storetabletpcforme.comdns
DNS Request
storetabletpcforme.com
-
8.8.8.8:53ourdatatransfers.comdns
DNS Request
ourdatatransfers.com
-
8.8.8.8:5318.134.221.88.in-addr.arpadns
DNS Request
18.134.221.88.in-addr.arpa
-
8.8.8.8:53151607e80915.edataupdate.netdns
DNS Request
151607e80915.edataupdate.net
-
8.8.8.8:53tse1.mm.bing.netdns
DNS Request
tse1.mm.bing.net
DNS Response
150.171.27.10150.171.28.10
-
8.8.8.8:53151607e80915.edataupdate.netdns
DNS Request
151607e80915.edataupdate.net
-
8.8.8.8:53151607e80915.edataupdate.netdns
DNS Request
151607e80915.edataupdate.net
-
8.8.8.8:53240.143.123.92.in-addr.arpadns
DNS Request
240.143.123.92.in-addr.arpa
-
8.8.8.8:53www.google.comdns
DNS Request
www.google.com
DNS Response
142.250.178.4
-
8.8.8.8:534.178.250.142.in-addr.arpadns
DNS Request
4.178.250.142.in-addr.arpa
-
8.8.8.8:53151607e80915.edataupdate.netdns
DNS Request
151607e80915.edataupdate.net
-
8.8.8.8:5331.243.111.52.in-addr.arpadns
DNS Request
31.243.111.52.in-addr.arpa
-
8.8.8.8:53151607e80915.edataupdate.netdns
DNS Request
151607e80915.edataupdate.net
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD578193d48f57272fd9ea2e44ed86d608c
SHA11e70368bb5a0932f868fdddb22fd23dd2e7dedeb
SHA256c09d0876bbf956eb381d92a3e9dd61d49a4d65c1d2b65d3d42cb795256804aae
SHA5124f55914fe2d3780f174843b9f3666a10f63caae9634af925da3dc6aea5a3f6ab9e6ebf693698b781931ce794919558c59f7bfa22be94dc8b556784d948fa14c1
-
Filesize
471B
MD5c5ae9f54c69f9746498f9a30aadf6d0f
SHA1fd076d7133bce1925d86039f32abf2ff8dac3d94
SHA25619a14eb8d7c9b00e80577a7199763fcea0e2feddcdb0b19def90bf631c7cba9d
SHA5123904209e4cae0f35795f076daaaeec12ce46200f99e9216340b7f6b636b809e0dd451101263f0a534bd3e42ec79fc1ee85f2fcd7562d05cbd1df9ea6c5300af8
-
Filesize
420B
MD5a1664d72f058eb4bcd5e0fb264154969
SHA17cba72525361fea3cf8efce0d502ad56bb1c06b1
SHA256ade5718c72ad3851fe6a9cd1240d823d9dfc581a9876807c58e7366d54bcc4d4
SHA512c252c1d124d5561920734cd53cef08b839a7ef2881224ab6eab8e8e67f477eafa11b1a25a963540dab9989753a8e795338803d492d40b8fac54334d0f8cf0130
-
Filesize
2KB
MD51c9b38b71fda6e60a8da97c4c79052f7
SHA15788458eb4eb5b6e56576f02784cec79dace6fab
SHA2566b8c7e568fc9bfb9c7d4c29b093eb583c8cf5feb1981bcf907fb9f2c18e7174b
SHA512eb7209bd8f29b62898c3507975bae837d413492ff370ba62631942d70daad8f017568e6308e4b69032eac3fc1964b815397b5449e7809b803e8f835c03f8c3c9
-
Filesize
96B
MD5188f8f76ad695de69c313c1113722ec5
SHA1acf66cf340e75c0997ab844f745ed139e05b5c1c
SHA256d926dfadf64142c9d6e871f8e3d4709e78b5e82e237fcde0680740eed9c82b5b
SHA51200eb7bda00afe8efe5b3f29460e2d92d173911f7deabb097d9995fb9af556371c4cecb473d328c8f9c7c85978fd560b1b9cec723805c44bd167ff59c3cf5bbf3
-
Filesize
6KB
MD5bee76c79e2e63e198038e01f0d571038
SHA1fcffdd6bb030f516a46e9d303ebae2ab33af222e
SHA25650a3c7134460bfe5f2840bd8dc957edfaa76da5beaaff70f8da5e0fef80ae876
SHA512dd2e9488ad365c02722e1a2466acffb8beaf4dbb68d7093e01c50cd915418ca0642cb6bdd43f2f2b014455803f3c69dec24ca9dfee11bdf7790379181cd2f6f9
-
Filesize
278KB
MD5c0b900a8932663eb7019fadf5bf040eb
SHA181ebb2aec972a23406cc3411eec2ba857fcf093b
SHA25645c2a8a44e726ba63180d1e87e6a16b9846c4d4279f05b2eebebef4c9223e690
SHA512103b5d0ce61db59159a566dfcb0a38ea10cd95c6e6db8a2c639b713d937d268a7182ce16150bb7eb3cce3b08be895ed220037004de0d5b9661c4150cc03b8832
-
Filesize
108KB
MD503b927c7c418bb244c2080e40bc7c20e
SHA1f8abf451378cbc13ec4c336456d0ba096ed64459
SHA256317d95ad3f8b58b6e7d7623e4ead965aea9eff10934280ca3cfa104f3d176f48
SHA512329102dee848ed482c07e3d7cd528088a7526179382d72cf9c5a8325519fe40a5adbb1f8bb560ccd4a8e876f4ca3f0e893f8983195ad775249844dcdf4e39747
-
Filesize
7.0MB
MD54a34de090e4e37d8d3f0b0ee0bdce371
SHA117972ddff6b799f794a7ad91bc84cff0f1d99a96
SHA256c3b3216b20f88209c71c4a85f81e2b42d2ae9a84af8db9f3cc2f2bdf29d992b9
SHA5120373baee90a6e7968e3a3f3aed34e32ba4b816af56323155972bdcfe8d6c8bd1026fcad0a130d61448de5db5aa8aa46a53f0bf74e5a12701573a0dc7bf865b32
-
Filesize
227KB
MD5cb6a5d7be9b7848a56c785c4d8902015
SHA15c533572e746689887bfd9ea759fdc1fdb4d0a2a
SHA25629fff191f7ea1fdb656d07544aeffdc0ff7f57c77edeb6b672e2ac040fdc0a5c
SHA5128235b2e065a01cedc5954e66135061c80e6c96da836626ac5fe71998dba8699674064d9d94e8a87a15c5059892c28dd83a5564902db9debe1faa1125a86db831
-
Filesize
108KB
MD57d7679b1493c32da08daae1949e9724c
SHA132da402420f912e637f2a54c73d54d31c73d4912
SHA2565f73756e6fafd121ddff05750d8c21a4d9a29d319b8022591787451af7766aa5
SHA5126a57805aa0d0df5020b0290d4b0121621a278dc97f31c93dfd64420a597d90212037e7559fe5550d2f68e850714fbfc326a887ec48651e3617725edf5258d15d
-
Filesize
996B
MD5e53716f331c2d8b5f1507593d42942fa
SHA12ea48756f9318e71ac1049ac07ef4ced4ea5fc6f
SHA25614aa40bbb4cf433ff5484a8966dd6761087f062fcb2b4199c701d1e6c7a52ec9
SHA5126bde4033c88e6122530104952fa5d96ec069a3945af6265efbab3f3fea6096dfdee3c682f97f9773a7cad5b7501f78ce98216d39cc38af53f994bbd43e6e83d4
-
Filesize
1KB
MD56741ac0f6179ea40ff4135835222f5e8
SHA1818ec58c6ab60ed4aab53c9e1cd2b6f364079c4e
SHA25667ffab0b5cf6f5ff879e87a0a3021afcf65815cdf9804a02bd927e722d486cc3
SHA51299c83a87235ec05f9765534fa1ce2809058b73abdc75ad96fff394f17a0258d546ba591ed36b12c25d4a18183bcb99993690471c4a837763d61a80ffda004879
-
Filesize
600B
MD5e4eb658fb827816f5cdc53ff75724a6d
SHA126ae22d60c572b85553e38795190394b819055f5
SHA256c553f71791784d04b4a87b7226abfb2ec64e7364c68524a4eb01cf3d68f4878a
SHA512fe614803efafb4035132aefefeb042b82d2acaf5a26d59d4bda703425c1d1297e196adf63b223f793dc769d7d3546149d1dce241529f6fea6bf70169be2d505a
-
Filesize
428KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
40KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
108KB
-
Filesize
108KB
-
Filesize
4KB