Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 20:20 UTC

General

  • Target

    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe

  • Size

    248KB

  • MD5

    d23262938f92e3b274f2ed4eecffc25e

  • SHA1

    0bfc8ca0e6b48039fefbeabc200cfd2611732c22

  • SHA256

    131f22f818130dfe0b44b9fd75f0e470f9dedb88d7c7cd6739249b7087f47244

  • SHA512

    ceb56fff12d994012831696a4827dcea649ce1c1f78862a985e607672c865197e6457ad564bb5ae299e505a9c6d45fff0e0efb617246ea69820caacc283723bc

  • SSDEEP

    6144:MrtCIyoJ5PUCdMt4iZKOeKWq2ZMNh1sBwwg2ZMPh0z:ozyoLFdaeK/wvhgIMPhE

Malware Config

Extracted

Family

simda

Attributes
  • dga

    gatyfus.com

    lyvyxor.com

    vojyqem.com

    qetyfuv.com

    puvyxil.com

    gahyqah.com

    lyryfyd.com

    vocyzit.com

    qegyqaq.com

    purydyv.com

    gacyzuz.com

    lygymoj.com

    vowydef.com

    qexylup.com

    pufymoq.com

    gaqydeb.com

    lyxylux.com

    vofymik.com

    qeqysag.com

    puzylyp.com

    gadyniw.com

    lymysan.com

    volykyc.com

    qedynul.com

    pumypog.com

    galykes.com

    lysynur.com

    vonypom.com

    qekykev.com

    pupybul.com

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Simda family
  • simda

    Simda is an infostealer written in C++.

  • Modifies WinLogon 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies WinLogon
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1940

Network

  • flag-us
    DNS
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gatyfus.com
    IN A
    Response
    gatyfus.com
    IN A
    5.79.71.225
    gatyfus.com
    IN A
    178.162.203.226
    gatyfus.com
    IN A
    178.162.203.211
    gatyfus.com
    IN A
    178.162.203.202
    gatyfus.com
    IN A
    178.162.217.107
    gatyfus.com
    IN A
    5.79.71.205
    gatyfus.com
    IN A
    85.17.31.122
    gatyfus.com
    IN A
    85.17.31.82
  • flag-us
    DNS
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gatyfus.com
    IN A
  • flag-us
    DNS
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gatyfus.com
    IN A
  • flag-us
    DNS
    vojyqem.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vojyqem.com
    IN A
    Response
  • flag-us
    DNS
    vojyqem.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vojyqem.com
    IN A
  • flag-us
    DNS
    vojyqem.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vojyqem.com
    IN A
  • flag-us
    DNS
    puvyxil.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puvyxil.com
    IN A
    Response
  • flag-us
    DNS
    puvyxil.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puvyxil.com
    IN A
  • flag-us
    DNS
    puvyxil.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puvyxil.com
    IN A
  • flag-us
    DNS
    lyryfyd.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyryfyd.com
    IN A
    Response
  • flag-us
    DNS
    lyryfyd.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyryfyd.com
    IN A
  • flag-us
    DNS
    lyryfyd.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyryfyd.com
    IN A
  • flag-us
    DNS
    qegyqaq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qegyqaq.com
    IN A
    Response
  • flag-us
    DNS
    qegyqaq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qegyqaq.com
    IN A
  • flag-us
    DNS
    qegyqaq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qegyqaq.com
    IN A
  • flag-us
    DNS
    gacyzuz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gacyzuz.com
    IN A
    Response
  • flag-us
    DNS
    gacyzuz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gacyzuz.com
    IN A
  • flag-us
    DNS
    gacyzuz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gacyzuz.com
    IN A
  • flag-us
    DNS
    vowydef.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vowydef.com
    IN A
    Response
  • flag-us
    DNS
    vowydef.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vowydef.com
    IN A
  • flag-us
    DNS
    vowydef.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vowydef.com
    IN A
  • flag-us
    DNS
    pufymoq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pufymoq.com
    IN A
    Response
  • flag-us
    DNS
    pufymoq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pufymoq.com
    IN A
  • flag-us
    DNS
    pufymoq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pufymoq.com
    IN A
  • flag-us
    DNS
    lyxylux.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyxylux.com
    IN A
    Response
  • flag-us
    DNS
    lyxylux.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyxylux.com
    IN A
  • flag-us
    DNS
    lyxylux.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyxylux.com
    IN A
  • flag-us
    DNS
    qeqysag.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qeqysag.com
    IN A
    Response
  • flag-us
    DNS
    qeqysag.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qeqysag.com
    IN A
  • flag-us
    DNS
    qeqysag.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qeqysag.com
    IN A
  • flag-us
    DNS
    gadyniw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadyniw.com
    IN A
    Response
    gadyniw.com
    IN A
    154.212.231.82
  • flag-us
    DNS
    gadyniw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadyniw.com
    IN A
  • flag-us
    DNS
    gadyniw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadyniw.com
    IN A
  • flag-us
    DNS
    volykyc.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    volykyc.com
    IN A
    Response
  • flag-us
    DNS
    volykyc.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    volykyc.com
    IN A
  • flag-us
    DNS
    volykyc.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    volykyc.com
    IN A
  • flag-us
    DNS
    pumypog.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pumypog.com
    IN A
    Response
  • flag-us
    DNS
    pumypog.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pumypog.com
    IN A
  • flag-us
    DNS
    pumypog.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pumypog.com
    IN A
  • flag-us
    DNS
    lysynur.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lysynur.com
    IN A
    Response
  • flag-us
    DNS
    lysynur.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lysynur.com
    IN A
  • flag-us
    DNS
    lysynur.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lysynur.com
    IN A
  • flag-us
    DNS
    qekykev.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qekykev.com
    IN A
    Response
  • flag-us
    DNS
    qekykev.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qekykev.com
    IN A
  • flag-us
    DNS
    qekykev.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qekykev.com
    IN A
  • flag-us
    DNS
    ganypih.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    ganypih.com
    IN A
    Response
  • flag-us
    DNS
    ganypih.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    ganypih.com
    IN A
  • flag-us
    DNS
    ganypih.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    ganypih.com
    IN A
  • flag-us
    DNS
    vopybyt.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vopybyt.com
    IN A
    Response
  • flag-us
    DNS
    vopybyt.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vopybyt.com
    IN A
  • flag-us
    DNS
    vopybyt.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vopybyt.com
    IN A
  • flag-us
    DNS
    pujyjav.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pujyjav.com
    IN A
    Response
  • flag-us
    DNS
    pujyjav.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pujyjav.com
    IN A
  • flag-us
    DNS
    pujyjav.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pujyjav.com
    IN A
  • flag-us
    DNS
    lyvytuj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyvytuj.com
    IN A
    Response
  • flag-us
    DNS
    lyvytuj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyvytuj.com
    IN A
  • flag-us
    DNS
    lyvytuj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyvytuj.com
    IN A
  • flag-us
    DNS
    qetyvep.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qetyvep.com
    IN A
    Response
  • flag-us
    DNS
    qetyvep.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qetyvep.com
    IN A
  • flag-us
    DNS
    qetyvep.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qetyvep.com
    IN A
  • flag-us
    DNS
    gahyhob.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyhob.com
    IN A
    Response
  • flag-us
    DNS
    gahyhob.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyhob.com
    IN A
  • flag-us
    DNS
    gahyhob.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyhob.com
    IN A
  • flag-us
    DNS
    vocyruk.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocyruk.com
    IN A
    Response
  • flag-us
    DNS
    vocyruk.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocyruk.com
    IN A
  • flag-us
    DNS
    vocyruk.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocyruk.com
    IN A
  • flag-us
    DNS
    purycap.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    purycap.com
    IN A
    Response
  • flag-us
    DNS
    purycap.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    purycap.com
    IN A
  • flag-us
    DNS
    purycap.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    purycap.com
    IN A
  • flag-us
    DNS
    lygygin.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lygygin.com
    IN A
    Response
  • flag-us
    DNS
    lygygin.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lygygin.com
    IN A
  • flag-us
    DNS
    lygygin.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lygygin.com
    IN A
  • flag-us
    DNS
    qexyryl.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qexyryl.com
    IN A
    Response
  • flag-us
    DNS
    qexyryl.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qexyryl.com
    IN A
  • flag-us
    DNS
    qexyryl.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qexyryl.com
    IN A
  • flag-us
    DNS
    gaqycos.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gaqycos.com
    IN A
    Response
  • flag-us
    DNS
    gaqycos.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gaqycos.com
    IN A
  • flag-us
    DNS
    gaqycos.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gaqycos.com
    IN A
  • flag-us
    DNS
    vofygum.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofygum.com
    IN A
    Response
  • flag-us
    DNS
    vofygum.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofygum.com
    IN A
  • flag-us
    DNS
    vofygum.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofygum.com
    IN A
  • flag-us
    DNS
    puzywel.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puzywel.com
    IN A
    Response
  • flag-us
    DNS
    puzywel.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puzywel.com
    IN A
  • flag-us
    DNS
    puzywel.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puzywel.com
    IN A
  • flag-us
    DNS
    lymyxid.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymyxid.com
    IN A
    Response
    lymyxid.com
    IN A
    3.94.10.34
  • flag-us
    DNS
    lymyxid.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymyxid.com
    IN A
  • flag-us
    DNS
    lymyxid.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymyxid.com
    IN A
  • flag-us
    DNS
    qedyfyq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qedyfyq.com
    IN A
    Response
  • flag-us
    DNS
    qedyfyq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qedyfyq.com
    IN A
  • flag-us
    DNS
    qedyfyq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qedyfyq.com
    IN A
  • flag-us
    DNS
    qedyfyq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qedyfyq.com
    IN A
  • flag-us
    DNS
    qedyfyq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qedyfyq.com
    IN A
  • flag-us
    DNS
    galyqaz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galyqaz.com
    IN A
    Response
    galyqaz.com
    IN A
    199.191.50.83
  • flag-us
    DNS
    galyqaz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galyqaz.com
    IN A
  • flag-us
    DNS
    galyqaz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galyqaz.com
    IN A
  • flag-us
    DNS
    vonyzuf.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vonyzuf.com
    IN A
    Response
  • flag-us
    DNS
    vonyzuf.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vonyzuf.com
    IN A
  • flag-us
    DNS
    vonyzuf.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vonyzuf.com
    IN A
  • flag-us
    DNS
    qetyfuv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qetyfuv.com
    IN A
    Response
    qetyfuv.com
    IN A
    44.221.84.105
  • flag-us
    DNS
    qetyfuv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qetyfuv.com
    IN A
  • flag-us
    DNS
    qetyfuv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qetyfuv.com
    IN A
  • flag-us
    DNS
    gahyqah.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyqah.com
    IN A
    Response
    gahyqah.com
    IN A
    23.253.46.64
    gahyqah.com
    IN A
    162.255.119.102
  • flag-us
    DNS
    gahyqah.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyqah.com
    IN A
  • flag-us
    DNS
    gahyqah.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyqah.com
    IN A
  • flag-us
    DNS
    vocyzit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocyzit.com
    IN A
    Response
    vocyzit.com
    IN A
    44.221.84.105
  • flag-us
    DNS
    vocyzit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocyzit.com
    IN A
  • flag-us
    DNS
    vocyzit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocyzit.com
    IN A
  • flag-us
    DNS
    vocyzit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocyzit.com
    IN A
  • flag-us
    DNS
    vocyzit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocyzit.com
    IN A
  • flag-us
    DNS
    purydyv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    purydyv.com
    IN A
    Response
  • flag-us
    DNS
    purydyv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    purydyv.com
    IN A
  • flag-us
    DNS
    purydyv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    purydyv.com
    IN A
  • flag-us
    DNS
    lygymoj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lygymoj.com
    IN A
    Response
  • flag-us
    DNS
    lygymoj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lygymoj.com
    IN A
  • flag-us
    DNS
    lygymoj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lygymoj.com
    IN A
  • flag-us
    DNS
    qexylup.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qexylup.com
    IN A
    Response
  • flag-us
    DNS
    qexylup.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qexylup.com
    IN A
  • flag-us
    DNS
    qexylup.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qexylup.com
    IN A
  • flag-us
    DNS
    gaqydeb.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gaqydeb.com
    IN A
    Response
  • flag-us
    DNS
    gaqydeb.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gaqydeb.com
    IN A
  • flag-us
    DNS
    gaqydeb.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gaqydeb.com
    IN A
  • flag-us
    DNS
    vofymik.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofymik.com
    IN A
    Response
  • flag-us
    DNS
    vofymik.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofymik.com
    IN A
  • flag-us
    DNS
    vofymik.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofymik.com
    IN A
  • flag-us
    DNS
    vofymik.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofymik.com
    IN A
  • flag-us
    DNS
    vofymik.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofymik.com
    IN A
  • flag-us
    DNS
    puzylyp.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puzylyp.com
    IN A
    Response
    puzylyp.com
    IN A
    99.83.170.3
    puzylyp.com
    IN A
    75.2.71.199
  • flag-us
    DNS
    puzylyp.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puzylyp.com
    IN A
  • flag-us
    DNS
    puzylyp.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puzylyp.com
    IN A
  • flag-us
    DNS
    lymysan.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymysan.com
    IN A
    Response
  • flag-us
    DNS
    lymysan.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymysan.com
    IN A
  • flag-us
    DNS
    lymysan.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymysan.com
    IN A
  • flag-us
    DNS
    lymysan.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymysan.com
    IN A
  • flag-us
    DNS
    lymysan.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymysan.com
    IN A
  • flag-us
    DNS
    qedynul.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qedynul.com
    IN A
    Response
  • flag-us
    DNS
    qedynul.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qedynul.com
    IN A
  • flag-us
    DNS
    qedynul.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qedynul.com
    IN A
  • flag-us
    DNS
    galykes.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galykes.com
    IN A
    Response
  • flag-us
    DNS
    galykes.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galykes.com
    IN A
  • flag-us
    DNS
    galykes.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galykes.com
    IN A
  • flag-us
    DNS
    galykes.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galykes.com
    IN A
  • flag-us
    DNS
    galykes.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galykes.com
    IN A
  • flag-us
    DNS
    vonypom.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vonypom.com
    IN A
    Response
    vonypom.com
    IN A
    34.227.7.138
  • flag-us
    DNS
    vonypom.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vonypom.com
    IN A
  • flag-us
    DNS
    vonypom.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vonypom.com
    IN A
  • flag-us
    DNS
    pupybul.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pupybul.com
    IN A
    Response
  • flag-us
    DNS
    pupybul.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pupybul.com
    IN A
  • flag-us
    DNS
    pupybul.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pupybul.com
    IN A
  • flag-us
    DNS
    pupybul.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pupybul.com
    IN A
  • flag-us
    DNS
    pupybul.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pupybul.com
    IN A
  • flag-us
    DNS
    lykyjad.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lykyjad.com
    IN A
    Response
  • flag-us
    DNS
    lykyjad.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lykyjad.com
    IN A
  • flag-us
    DNS
    lykyjad.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lykyjad.com
    IN A
  • flag-us
    DNS
    qebytiq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qebytiq.com
    IN A
    Response
  • flag-us
    DNS
    qebytiq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qebytiq.com
    IN A
  • flag-us
    DNS
    qebytiq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qebytiq.com
    IN A
  • flag-us
    DNS
    qebytiq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qebytiq.com
    IN A
  • flag-us
    DNS
    qebytiq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qebytiq.com
    IN A
  • flag-us
    DNS
    gatyvyz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gatyvyz.com
    IN A
    Response
  • flag-us
    DNS
    gatyvyz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gatyvyz.com
    IN A
  • flag-us
    DNS
    gatyvyz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gatyvyz.com
    IN A
  • flag-us
    DNS
    vojyjof.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vojyjof.com
    IN A
    Response
  • flag-us
    DNS
    vojyjof.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vojyjof.com
    IN A
  • flag-us
    DNS
    vojyjof.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vojyjof.com
    IN A
  • flag-us
    DNS
    vojyjof.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vojyjof.com
    IN A
  • flag-us
    DNS
    puvytuq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puvytuq.com
    IN A
    Response
  • flag-us
    DNS
    puvytuq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puvytuq.com
    IN A
  • flag-us
    DNS
    puvytuq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puvytuq.com
    IN A
  • flag-us
    DNS
    lyryvex.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyryvex.com
    IN A
    Response
  • flag-us
    DNS
    lyryvex.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyryvex.com
    IN A
  • flag-us
    DNS
    qegyhig.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qegyhig.com
    IN A
    Response
    qegyhig.com
    IN A
    104.21.16.1
    qegyhig.com
    IN A
    104.21.96.1
    qegyhig.com
    IN A
    104.21.64.1
    qegyhig.com
    IN A
    104.21.112.1
    qegyhig.com
    IN A
    104.21.48.1
    qegyhig.com
    IN A
    104.21.80.1
    qegyhig.com
    IN A
    104.21.32.1
  • flag-us
    DNS
    qegyhig.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qegyhig.com
    IN A
  • flag-us
    DNS
    gacyryw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gacyryw.com
    IN A
    Response
  • flag-us
    DNS
    gacyryw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gacyryw.com
    IN A
  • flag-us
    DNS
    vowycac.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vowycac.com
    IN A
    Response
  • flag-us
    DNS
    vowycac.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vowycac.com
    IN A
  • flag-us
    DNS
    pufygug.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pufygug.com
    IN A
    Response
  • flag-us
    DNS
    pufygug.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pufygug.com
    IN A
  • flag-us
    DNS
    lyxywer.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyxywer.com
    IN A
    Response
  • flag-us
    DNS
    lyxywer.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyxywer.com
    IN A
  • flag-us
    DNS
    qeqyxov.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qeqyxov.com
    IN A
    Response
  • flag-us
    DNS
    qeqyxov.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qeqyxov.com
    IN A
  • flag-us
    DNS
    gadyfuh.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadyfuh.com
    IN A
    Response
  • flag-us
    DNS
    gadyfuh.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadyfuh.com
    IN A
  • flag-us
    DNS
    volyqat.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    volyqat.com
    IN A
    Response
  • flag-us
    DNS
    volyqat.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    volyqat.com
    IN A
  • flag-us
    DNS
    pumyxiv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pumyxiv.com
    IN A
    Response
  • flag-us
    DNS
    pumyxiv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pumyxiv.com
    IN A
  • flag-us
    DNS
    lysyfyj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lysyfyj.com
    IN A
    Response
  • flag-us
    DNS
    lysyfyj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lysyfyj.com
    IN A
  • flag-us
    DNS
    qekyqop.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qekyqop.com
    IN A
    Response
  • flag-us
    DNS
    qekyqop.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qekyqop.com
    IN A
  • flag-us
    DNS
    lyvyxor.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyvyxor.com
    IN A
    Response
  • flag-us
    DNS
    lyvyxor.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyvyxor.com
    IN A
  • flag-us
    DNS
    qegyhig.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qegyhig.com
    IN A
    Response
    qegyhig.com
    IN A
    104.21.112.1
    qegyhig.com
    IN A
    104.21.64.1
    qegyhig.com
    IN A
    104.21.80.1
    qegyhig.com
    IN A
    104.21.48.1
    qegyhig.com
    IN A
    104.21.96.1
    qegyhig.com
    IN A
    104.21.16.1
    qegyhig.com
    IN A
    104.21.32.1
  • flag-us
    POST
    http://qegyhig.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    104.21.112.1:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: qegyhig.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sun, 19 Jan 2025 20:20:49 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: keep-alive
    Location: https://qegyhig.com/login.php
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8qkln3SmSvqzokKb5gR6wsy8YJd36vO2hSspMaCeRvTnIxtPxYRodCjVl2RuGVRsDSVtfQKtE%2F6yNCLDqAF2Myb4kvjua1EY3iwgvChrYb8Ex3wdG%2BhyewPZQldh1Q%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 904987100d1def45-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=356248&min_rtt=356248&rtt_var=178124&sent=1&recv=2&lost=0&retrans=0&sent_bytes=0&recv_bytes=346&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    POST
    http://qegyhig.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    104.21.112.1:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: qegyhig.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sun, 19 Jan 2025 20:20:57 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: keep-alive
    Location: https://qegyhig.com/login.php
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lx%2BASE50cJICNMGlIvBhHj65Sh5eeKDuqpiteM%2FGog%2B4gD8iS30a46l1NPV2UNMuxTSURCc6aVwycx44HnKy9T4XwtGSVVBTi3hruM%2F0XCXPDTx5PLEAr9maNIaw8w%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 904987452fdeef45-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=356248&min_rtt=356248&rtt_var=178124&sent=7&recv=5&lost=0&retrans=3&sent_bytes=2989&recv_bytes=692&delivery_rate=1729&cwnd=251&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    DNS
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gatyfus.com
    IN A
    Response
    gatyfus.com
    IN A
    85.17.31.122
    gatyfus.com
    IN A
    178.162.203.202
    gatyfus.com
    IN A
    178.162.217.107
    gatyfus.com
    IN A
    178.162.203.226
    gatyfus.com
    IN A
    178.162.203.211
    gatyfus.com
    IN A
    85.17.31.82
    gatyfus.com
    IN A
    5.79.71.225
    gatyfus.com
    IN A
    5.79.71.205
  • flag-us
    DNS
    puzylyp.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puzylyp.com
    IN A
    Response
    puzylyp.com
    IN A
    99.83.170.3
    puzylyp.com
    IN A
    75.2.71.199
  • flag-us
    DNS
    gahyqah.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyqah.com
    IN A
    Response
    gahyqah.com
    IN A
    162.255.119.102
    gahyqah.com
    IN A
    23.253.46.64
  • flag-us
    DNS
    gahyqah.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyqah.com
    IN A
  • flag-us
    DNS
    gahyqah.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyqah.com
    IN A
  • flag-us
    POST
    http://puzylyp.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    99.83.170.3:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: puzylyp.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 308 Permanent Redirect
    Connection: close
    Location: https://puzylyp.com/login.php
    Server: Caddy
    Date: Sun, 19 Jan 2025 20:20:55 GMT
    Content-Length: 0
  • flag-us
    DNS
    lymyxid.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymyxid.com
    IN A
    Response
    lymyxid.com
    IN A
    3.94.10.34
  • flag-us
    DNS
    qetyfuv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qetyfuv.com
    IN A
    Response
    qetyfuv.com
    IN A
    44.221.84.105
  • flag-us
    DNS
    vonypom.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vonypom.com
    IN A
    Response
    vonypom.com
    IN A
    34.227.7.138
  • flag-us
    DNS
    galyqaz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galyqaz.com
    IN A
    Response
    galyqaz.com
    IN A
    199.191.50.83
  • flag-us
    POST
    http://vonypom.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    34.227.7.138:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: vonypom.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 19 Jan 2025 20:20:59 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=d66b71adf898e2c8d21c9e08b5591c9c|181.215.176.83|1737318059|1737318059|0|1|0; path=/; domain=.vonypom.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=181.215.176.83; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    DNS
    gadyniw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadyniw.com
    IN A
    Response
    gadyniw.com
    IN A
    154.212.231.82
  • flag-us
    DNS
    gadyniw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadyniw.com
    IN A
  • flag-us
    DNS
    gadyniw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadyniw.com
    IN A
  • flag-us
    POST
    http://lymyxid.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    3.94.10.34:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: lymyxid.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 19 Jan 2025 20:20:53 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=94e2003523c6d8950a8a4e329b8eb4df|181.215.176.83|1737318053|1737318053|0|1|0; path=/; domain=.lymyxid.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=181.215.176.83; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    POST
    http://galyqaz.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    199.191.50.83:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: galyqaz.com
    Content-Length: 9
    Cache-Control: no-cache
  • flag-us
    POST
    http://galyqaz.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    199.191.50.83:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: galyqaz.com
    Content-Length: 9
    Cache-Control: no-cache
  • flag-us
    POST
    http://gahyqah.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    162.255.119.102:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: gahyqah.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 302 Found
    Date: Sun, 19 Jan 2025 20:20:55 GMT
    Content-Length: 0
    Connection: keep-alive
    Location: http://www.gahyqah.com/login.php
    X-Served-By: Namecheap URL Forward
    Server: namecheap-nginx
  • flag-hk
    POST
    http://gadyniw.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    154.212.231.82:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: gadyniw.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Sun, 19 Jan 2025 20:20:54 GMT
    Content-Type: text/html
    Content-Length: 548
    Connection: keep-alive
  • flag-hk
    POST
    http://gadyniw.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    154.212.231.82:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: gadyniw.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Sun, 19 Jan 2025 20:20:54 GMT
    Content-Type: text/html
    Content-Length: 548
    Connection: keep-alive
  • flag-us
    GET
    https://qegyhig.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /login.php HTTP/1.1
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: qegyhig.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 19 Jan 2025 20:20:57 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    vary: Accept-Encoding
    expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4JWRml1JKXy%2FxLoRkumkmV9eKOml970A4s89H9p6L%2BXnLsJGOqf%2FNBHhwXlXxh8GMMq1DTevZuJMuI3d856TsS7xvosbXkjEk0t41RwDkWKoJyNBDrMMbPAzCueceQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 904987428d0ebd6f-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=72507&min_rtt=47380&rtt_var=59811&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3135&recv_bytes=609&delivery_rate=75207&cwnd=253&unsent_bytes=0&cid=31534af5ec68cc00&ts=786&x=0"
  • flag-us
    DNS
    www.gahyqah.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    www.gahyqah.com
    IN A
    Response
    www.gahyqah.com
    IN CNAME
    parkingpage.namecheap.com
    parkingpage.namecheap.com
    IN A
    91.195.240.19
  • flag-de
    GET
    http://www.gahyqah.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    91.195.240.19:80
    Request
    GET /login.php HTTP/1.1
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: www.gahyqah.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    date: Sun, 19 Jan 2025 20:20:55 GMT
    content-type: text/html; charset=UTF-8
    transfer-encoding: chunked
    vary: Accept-Encoding
    expires: Mon, 26 Jul 1997 05:00:00 GMT
    cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    pragma: no-cache
    x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_g5rlXs9RuRW4dglqQ5LydJEttSTVBsfpTg5YbTbTgxQyCxJaX/4wWztIAOuRl2yVYhX0WGF1Yaew3U85nGI5uA==
    last-modified: Sun, 19 Jan 2025 20:20:55 GMT
    x-cache-miss-from: parking-5f7bdb5f75-bpnxv
    server: Parking/1.0
  • flag-us
    DNS
    vocyzit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocyzit.com
    IN A
    Response
    vocyzit.com
    IN A
    44.221.84.105
  • flag-us
    POST
    http://puzylyp.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    99.83.170.3:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: puzylyp.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 308 Permanent Redirect
    Connection: close
    Location: https://puzylyp.com/login.php
    Server: Caddy
    Date: Sun, 19 Jan 2025 20:20:56 GMT
    Content-Length: 0
  • flag-us
    DNS
    c.pki.goog
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.178.3
  • flag-gb
    GET
    http://c.pki.goog/r/gsr1.crl
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    142.250.178.3:80
    Request
    GET /r/gsr1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 1739
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Sun, 19 Jan 2025 19:40:33 GMT
    Expires: Sun, 19 Jan 2025 20:30:33 GMT
    Cache-Control: public, max-age=3000
    Age: 2424
    Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-gb
    GET
    http://c.pki.goog/r/r4.crl
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    142.250.178.3:80
    Request
    GET /r/r4.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 436
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Sun, 19 Jan 2025 20:01:52 GMT
    Expires: Sun, 19 Jan 2025 20:51:52 GMT
    Cache-Control: public, max-age=3000
    Age: 1145
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    GET
    https://qegyhig.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    104.21.112.1:443
    Request
    GET /login.php HTTP/1.1
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: qegyhig.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 19 Jan 2025 20:20:58 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    vary: Accept-Encoding
    expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    link: <https://qegyhig.com/wp-json/>; rel="https://api.w.org/"
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VXheOhhqIjj90VIkaSCf8ELmygr9Z9a5hsvSQRKsPoogQo8Xdu%2FrBiY4xaCIePLEdO2CVaLXkQ9ot2t1dLkuvAeIdpEHRFm1bxAwdmgFKvIaYMQEbTCrmOvG1ivCTQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 90498747c8b46535-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=49686&min_rtt=47312&rtt_var=14241&sent=6&recv=6&lost=0&retrans=0&sent_bytes=3136&recv_bytes=641&delivery_rate=77373&cwnd=234&unsent_bytes=0&cid=ca29ba4860e7728b&ts=515&x=0"
  • flag-us
    DNS
    crl.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    crl.microsoft.com
    IN A
    Response
    crl.microsoft.com
    IN CNAME
    crl.www.ms.akadns.net
    crl.www.ms.akadns.net
    IN CNAME
    a1363.dscg.akamai.net
    a1363.dscg.akamai.net
    IN A
    2.19.252.157
    a1363.dscg.akamai.net
    IN A
    2.19.252.143
  • flag-gb
    GET
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    Remote address:
    2.19.252.157:80
    Request
    GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 11 Jul 2024 01:45:51 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: crl.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1036
    Content-Type: application/octet-stream
    Content-MD5: +oTkvMkqpdtzWrUHEQQM3g==
    Last-Modified: Thu, 12 Dec 2024 00:06:56 GMT
    ETag: 0x8DD1A40E476D877
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 4de8ec0b-c01e-0047-3936-4c3cb1000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Sun, 19 Jan 2025 20:21:28 GMT
    Connection: keep-alive
  • flag-us
    DNS
    www.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    104.121.237.231
  • flag-dk
    GET
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    Remote address:
    104.121.237.231:80
    Request
    GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Sun, 18 Aug 2024 00:23:49 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: www.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1078
    Content-Type: application/octet-stream
    Content-MD5: HqJzZuA065RHozzmOcAUiQ==
    Last-Modified: Tue, 14 Jan 2025 20:41:31 GMT
    ETag: 0x8DD34DBD43549F4
    x-ms-request-id: aa6432cd-001e-0067-63cb-664716000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Sun, 19 Jan 2025 20:21:28 GMT
    Connection: keep-alive
    TLS_version: UNKNOWN
    ms-cv: CASMicrosoftCVea9a07fb.0
    ms-cv-esi: CASMicrosoftCVea9a07fb.0
    X-RTag: RT
  • flag-nl
    POST
    http://gatyfus.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    5.79.71.225:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: gatyfus.com
    Content-Length: 9
    Cache-Control: no-cache
  • flag-us
    DNS
    ganyzub.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    ganyzub.com
    IN A
    Response
  • flag-us
    DNS
    vopydek.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vopydek.com
    IN A
    Response
  • flag-us
    DNS
    pujymip.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pujymip.com
    IN A
    Response
  • flag-us
    DNS
    lyvylyn.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyvylyn.com
    IN A
    Response
  • flag-us
    DNS
    gahynus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahynus.com
    IN A
    Response
  • flag-us
    DNS
    qetysal.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qetysal.com
    IN A
    Response
  • flag-us
    DNS
    vocykem.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vocykem.com
    IN A
    Response
  • flag-us
    DNS
    purypol.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    purypol.com
    IN A
    Response
  • flag-us
    DNS
    lygynud.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lygynud.com
    IN A
    Response
    lygynud.com
    IN A
    3.94.10.34
  • flag-us
    DNS
    qexykaq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qexykaq.com
    IN A
    Response
  • flag-us
    DNS
    gaqypiz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gaqypiz.com
    IN A
    Response
  • flag-us
    DNS
    vofybyf.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofybyf.com
    IN A
    Response
  • flag-us
    DNS
    puzyjoq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puzyjoq.com
    IN A
    Response
  • flag-us
    DNS
    lymytux.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymytux.com
    IN A
    Response
  • flag-us
    DNS
    qedyveg.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qedyveg.com
    IN A
    Response
  • flag-us
    DNS
    galyhiw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    galyhiw.com
    IN A
    Response
  • flag-us
    DNS
    vonyryc.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vonyryc.com
    IN A
    Response
  • flag-us
    DNS
    lykymox.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lykymox.com
    IN A
    Response
  • flag-us
    DNS
    pupycag.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pupycag.com
    IN A
    Response
    pupycag.com
    IN A
    34.227.7.138
  • flag-us
    DNS
    lykygur.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lykygur.com
    IN A
    Response
  • flag-us
    DNS
    qebylug.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qebylug.com
    IN A
    Response
  • flag-us
    DNS
    qebyrev.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qebyrev.com
    IN A
    Response
  • flag-us
    DNS
    gatycoh.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gatycoh.com
    IN A
    Response
  • flag-us
    DNS
    gatydaw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gatydaw.com
    IN A
    Response
  • flag-us
    DNS
    vojygut.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vojygut.com
    IN A
    Response
  • flag-us
    DNS
    puvywav.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puvywav.com
    IN A
    Response
  • flag-us
    DNS
    puvylyg.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puvylyg.com
    IN A
    Response
  • flag-us
    DNS
    lyryxij.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyryxij.com
    IN A
    Response
  • flag-us
    DNS
    vojymic.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vojymic.com
    IN A
    Response
  • flag-us
    DNS
    qegyfyp.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qegyfyp.com
    IN A
    Response
  • flag-us
    DNS
    gacyqob.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gacyqob.com
    IN A
    Response
  • flag-us
    DNS
    lyrysor.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyrysor.com
    IN A
    Response
    lyrysor.com
    IN CNAME
    zz1985.qu200.com
    zz1985.qu200.com
    IN CNAME
    gtm-sg-6l13ukk0m05.qu200.com
    gtm-sg-6l13ukk0m05.qu200.com
    IN A
    172.233.130.182
  • flag-us
    DNS
    vowyzuk.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vowyzuk.com
    IN A
    Response
  • flag-us
    DNS
    pufydep.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pufydep.com
    IN A
    Response
  • flag-us
    DNS
    qegynuv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qegynuv.com
    IN A
    Response
  • flag-us
    DNS
    lyxymin.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyxymin.com
    IN A
    Response
  • flag-us
    DNS
    qeqylyl.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qeqylyl.com
    IN A
    Response
  • flag-us
    DNS
    gacykeh.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gacykeh.com
    IN A
    Response
  • flag-us
    DNS
    gadydas.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadydas.com
    IN A
    Response
  • flag-us
    DNS
    volymum.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    volymum.com
    IN A
    Response
  • flag-us
    DNS
    vowypit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vowypit.com
    IN A
    Response
  • flag-us
    DNS
    pufybyv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pufybyv.com
    IN A
    Response
  • flag-us
    DNS
    lyxyjaj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyxyjaj.com
    IN A
    Response
  • flag-us
    DNS
    lyxyjaj.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyxyjaj.com
    IN A
  • flag-us
    DNS
    qeqytup.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qeqytup.com
    IN A
    Response
  • flag-us
    DNS
    qeqytup.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qeqytup.com
    IN A
  • flag-us
    DNS
    gadyveb.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gadyveb.com
    IN A
    Response
  • flag-us
    DNS
    volyjok.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    volyjok.com
    IN A
    Response
  • flag-us
    DNS
    pumytup.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pumytup.com
    IN A
    Response
  • flag-us
    DNS
    lysyvan.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lysyvan.com
    IN A
    Response
    lysyvan.com
    IN A
    104.21.96.1
    lysyvan.com
    IN A
    104.21.80.1
    lysyvan.com
    IN A
    104.21.64.1
    lysyvan.com
    IN A
    104.21.112.1
    lysyvan.com
    IN A
    104.21.48.1
    lysyvan.com
    IN A
    104.21.32.1
    lysyvan.com
    IN A
    104.21.16.1
  • flag-us
    DNS
    qekyhil.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qekyhil.com
    IN A
    Response
  • flag-us
    DNS
    ganyrys.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    ganyrys.com
    IN A
    Response
  • flag-us
    DNS
    vopycom.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vopycom.com
    IN A
    Response
  • flag-us
    DNS
    pujygul.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pujygul.com
    IN A
    Response
  • flag-us
    DNS
    lyvywed.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyvywed.com
    IN A
    Response
  • flag-us
    DNS
    qetyxiq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qetyxiq.com
    IN A
    Response
  • flag-us
    DNS
    gahyfyz.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gahyfyz.com
    IN A
    Response
  • flag-us
    DNS
    puryxuq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puryxuq.com
    IN A
    Response
  • flag-us
    DNS
    lygyfex.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lygyfex.com
    IN A
    Response
  • flag-us
    DNS
    pupydeq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pupydeq.com
    IN A
    Response
    pupydeq.com
    IN A
    13.248.169.48
    pupydeq.com
    IN A
    76.223.54.146
  • flag-us
    DNS
    qexyqog.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    qexyqog.com
    IN A
    Response
  • flag-us
    DNS
    gaqyzuw.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    gaqyzuw.com
    IN A
    Response
  • flag-us
    DNS
    vofydac.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofydac.com
    IN A
    Response
  • flag-us
    DNS
    vofydac.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    vofydac.com
    IN A
  • flag-us
    DNS
    puzymig.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    puzymig.com
    IN A
    Response
  • flag-us
    DNS
    lymylyr.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lymylyr.com
    IN A
    Response
  • flag-us
    DNS
    pupydeq.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pupydeq.com
    IN A
    Response
    pupydeq.com
    IN A
    76.223.54.146
    pupydeq.com
    IN A
    13.248.169.48
  • flag-us
    DNS
    lysyvan.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lysyvan.com
    IN A
    Response
    lysyvan.com
    IN A
    104.21.16.1
    lysyvan.com
    IN A
    104.21.80.1
    lysyvan.com
    IN A
    104.21.64.1
    lysyvan.com
    IN A
    104.21.48.1
    lysyvan.com
    IN A
    104.21.32.1
    lysyvan.com
    IN A
    104.21.96.1
    lysyvan.com
    IN A
    104.21.112.1
  • flag-us
    DNS
    pupycag.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    pupycag.com
    IN A
    Response
    pupycag.com
    IN A
    34.227.7.138
  • flag-us
    DNS
    lygynud.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lygynud.com
    IN A
    Response
    lygynud.com
    IN A
    3.94.10.34
  • flag-us
    POST
    http://pupydeq.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    76.223.54.146:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: pupydeq.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 405 Method Not Allowed
    content-length: 0
  • flag-us
    POST
    http://pupydeq.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    76.223.54.146:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: pupydeq.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 405 Method Not Allowed
    content-length: 0
  • flag-us
    DNS
    lyrysor.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    8.8.8.8:53
    Request
    lyrysor.com
    IN A
    Response
    lyrysor.com
    IN CNAME
    zz1985.qu200.com
    zz1985.qu200.com
    IN CNAME
    gtm-sg-6l13ukk0m05.qu200.com
    gtm-sg-6l13ukk0m05.qu200.com
    IN A
    172.233.130.182
  • flag-us
    POST
    http://lysyvan.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    104.21.16.1:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: lysyvan.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sun, 19 Jan 2025 20:22:30 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: keep-alive
    Location: https://lysyvan.com/login.php
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HG%2FeelqQ7Tj9Qdnp5lRdj%2FGNZY3YcktKwzfSnCQD4VjhVacO0jNG5tzCHZRKpWdmXeg7LI6Bsr0i2yGA411%2BZmREyJJ6EWlzPsMgLvlcNcCoXTSv%2BiH%2B8aS1DKBK3Q%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 904989867e4263b5-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=47133&min_rtt=47133&rtt_var=23566&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=346&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    POST
    http://lysyvan.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    104.21.16.1:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: lysyvan.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Sun, 19 Jan 2025 20:22:34 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: keep-alive
    Location: https://lysyvan.com/login.php
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=seTKINV2LASUDwA6B8HcndyBDm6FaGPu7jYF7P3N5uJQMSfk5%2F4ZW8tgU2oT7Taj43xV3Mu%2B1VU4UDaifbPcin8ijJrRs1LhzV3aVGBp79n8mqJ6XUhfJ5uYJCWbyQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9049899f5cfb63b5-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=78895&min_rtt=47133&rtt_var=73958&sent=5&recv=6&lost=0&retrans=0&sent_bytes=1001&recv_bytes=692&delivery_rate=29404&cwnd=252&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    POST
    http://lyrysor.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    172.233.130.182:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: lyrysor.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 302 Moved Temporarily
    Server: openresty/1.25.3.1
    Date: Sun, 19 Jan 2025 20:22:30 GMT
    Content-Type: text/html
    Content-Length: 151
    Connection: keep-alive
    Location: http://47.102.219.3:8000/dh/147287063_779485.html#index8?d=lyrysor.com
  • flag-us
    POST
    http://lyrysor.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    172.233.130.182:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: lyrysor.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 302 Moved Temporarily
    Server: openresty/1.25.3.1
    Date: Sun, 19 Jan 2025 20:22:51 GMT
    Content-Type: text/html
    Content-Length: 151
    Connection: keep-alive
    Location: http://47.102.219.3:8000/dh/147287063_779485.html#index8?d=lyrysor.com
  • flag-us
    POST
    http://pupycag.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    34.227.7.138:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: pupycag.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 19 Jan 2025 20:22:30 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=6e6945abc917efe6ff1a10915b49d386|181.215.176.83|1737318150|1737318150|0|1|0; path=/; domain=.pupycag.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=181.215.176.83; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    POST
    http://lygynud.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    3.94.10.34:80
    Request
    POST /login.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: lygynud.com
    Content-Length: 9
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 19 Jan 2025 20:22:30 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=8fd3e2faf58f1ce2f69844e17595c71b|181.215.176.83|1737318150|1737318150|0|1|0; path=/; domain=.lygynud.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=181.215.176.83; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    https://lysyvan.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    104.21.16.1:443
    Request
    GET /login.php HTTP/1.1
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: lysyvan.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 19 Jan 2025 20:22:34 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    vary: Accept-Encoding
    expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
    server-timing: amp_sanitizer;dur="26.4",amp_style_sanitizer;dur="14.6",amp_tag_and_attribute_sanitizer;dur="9.5",amp_optimizer;dur="4.6"
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Os2xC0nQUEBVgwRNyoEE3zDEcMiKggtbRyGt7ugVDnQDADHa3S4et4PLyBd5NicIxn0n8QlnDuyBGZI9yp%2FuPVHNYPIFDO18SCSTXgMEH6GCdWRefHPJVeEM1a8Z6g%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 9049899c4d5e93db-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=60682&min_rtt=51253&rtt_var=17783&sent=6&recv=6&lost=0&retrans=0&sent_bytes=3130&recv_bytes=609&delivery_rate=72267&cwnd=245&unsent_bytes=0&cid=ce090e333bb60a71&ts=573&x=0"
  • flag-us
    GET
    https://lysyvan.com/login.php
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    Remote address:
    104.21.16.1:443
    Request
    GET /login.php HTTP/1.1
    Referer: http://www.google.com
    User-Agent: Mozilla/4.0 (compatible; MSIE 2.0; Windows NT 5.0; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)
    Host: lysyvan.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 404 Not Found
    Date: Sun, 19 Jan 2025 20:22:35 GMT
    Content-Type: text/html; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    vary: Accept-Encoding
    expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    link: <https://lysyvan.com/wp-json/>; rel="https://api.w.org/"
    server-timing: amp_sanitizer;dur="20.1",amp_style_sanitizer;dur="9.1",amp_tag_and_attribute_sanitizer;dur="8.6",amp_optimizer;dur="2.7"
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RIsSVD%2Fhb9f2Z4mLl3W%2FHB82pmffdZ4dnmuM2Hyr%2F%2FljTn%2FB2sSK8vxENy8YLBuGc8w%2FAtbBE1l0TwR9QRuHggBs%2B2NIJ18iv34IfTShX6GIrMtRk7zxtGCC%2BzcStA%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 904989a2186763b5-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=52459&min_rtt=47214&rtt_var=18759&sent=6&recv=6&lost=0&retrans=0&sent_bytes=3132&recv_bytes=641&delivery_rate=69679&cwnd=253&unsent_bytes=0&cid=514413ef22016d01&ts=596&x=0"
  • 92.123.128.190:80
    www.bing.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    282 B
    132 B
    6
    3
  • 104.21.112.1:80
    http://qegyhig.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    1.5kB
    2.4kB
    11
    9

    HTTP Request

    POST http://qegyhig.com/login.php

    HTTP Response

    301

    HTTP Request

    POST http://qegyhig.com/login.php

    HTTP Response

    301
  • 85.17.31.122:80
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    40 B
    3
    1
  • 99.83.170.3:80
    http://puzylyp.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    1.1kB
    418 B
    8
    6

    HTTP Request

    POST http://puzylyp.com/login.php

    HTTP Response

    308
  • 44.221.84.105:80
    qetyfuv.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    3
  • 34.227.7.138:80
    http://vonypom.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    676 B
    619 B
    7
    5

    HTTP Request

    POST http://vonypom.com/login.php

    HTTP Response

    200
  • 3.94.10.34:80
    http://lymyxid.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    628 B
    627 B
    6
    5

    HTTP Request

    POST http://lymyxid.com/login.php

    HTTP Response

    200
  • 199.191.50.83:80
    http://galyqaz.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    484 B
    92 B
    3
    2

    HTTP Request

    POST http://galyqaz.com/login.php
  • 199.191.50.83:80
    http://galyqaz.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    484 B
    92 B
    3
    2

    HTTP Request

    POST http://galyqaz.com/login.php
  • 162.255.119.102:80
    http://gahyqah.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    950 B
    379 B
    13
    4

    HTTP Request

    POST http://gahyqah.com/login.php

    HTTP Response

    302
  • 154.212.231.82:80
    http://gadyniw.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    1.6kB
    1.6kB
    13
    6

    HTTP Request

    POST http://gadyniw.com/login.php

    HTTP Response

    404

    HTTP Request

    POST http://gadyniw.com/login.php

    HTTP Response

    404
  • 104.21.112.1:443
    https://qegyhig.com/login.php
    tls, http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    3.8kB
    73.6kB
    69
    69

    HTTP Request

    GET https://qegyhig.com/login.php

    HTTP Response

    404
  • 91.195.240.19:80
    http://www.gahyqah.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    1.3kB
    26.2kB
    22
    22

    HTTP Request

    GET http://www.gahyqah.com/login.php

    HTTP Response

    200
  • 44.221.84.105:80
    vocyzit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    3
  • 99.83.170.3:80
    http://puzylyp.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    622 B
    418 B
    6
    6

    HTTP Request

    POST http://puzylyp.com/login.php

    HTTP Response

    308
  • 142.250.178.3:80
    http://c.pki.goog/r/r4.crl
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    554 B
    3.8kB
    7
    5

    HTTP Request

    GET http://c.pki.goog/r/gsr1.crl

    HTTP Response

    200

    HTTP Request

    GET http://c.pki.goog/r/r4.crl

    HTTP Response

    200
  • 104.21.112.1:443
    https://qegyhig.com/login.php
    tls, http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    3.3kB
    80.7kB
    58
    70

    HTTP Request

    GET https://qegyhig.com/login.php

    HTTP Response

    404
  • 178.162.203.202:80
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    3
  • 44.221.84.105:80
    vocyzit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    3
  • 44.221.84.105:80
    vocyzit.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    3
  • 178.162.217.107:80
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    120 B
    3
    3
  • 178.162.203.226:80
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    120 B
    3
    3
  • 178.162.203.211:80
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    3
  • 2.19.252.157:80
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    http
    399 B
    1.7kB
    4
    4

    HTTP Request

    GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

    HTTP Response

    200
  • 104.121.237.231:80
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    http
    393 B
    1.7kB
    4
    4

    HTTP Request

    GET http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

    HTTP Response

    200
  • 85.17.31.82:80
    gatyfus.com
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    80 B
    3
    2
  • 5.79.71.225:80
    http://gatyfus.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    582 B
    88 B
    5
    2

    HTTP Request

    POST http://gatyfus.com/login.php
  • 76.223.54.146:80
    http://pupydeq.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    1.1kB
    414 B
    8
    6

    HTTP Request

    POST http://pupydeq.com/login.php

    HTTP Response

    405

    HTTP Request

    POST http://pupydeq.com/login.php

    HTTP Response

    405
  • 104.21.16.1:80
    http://lysyvan.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    1.1kB
    2.4kB
    8
    9

    HTTP Request

    POST http://lysyvan.com/login.php

    HTTP Response

    301

    HTTP Request

    POST http://lysyvan.com/login.php

    HTTP Response

    301
  • 172.233.130.182:80
    http://lyrysor.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    1.0kB
    1.0kB
    7
    5

    HTTP Request

    POST http://lyrysor.com/login.php

    HTTP Response

    302

    HTTP Request

    POST http://lyrysor.com/login.php

    HTTP Response

    302
  • 34.227.7.138:80
    http://pupycag.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    576 B
    619 B
    5
    5

    HTTP Request

    POST http://pupycag.com/login.php

    HTTP Response

    200
  • 3.94.10.34:80
    http://lygynud.com/login.php
    http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    576 B
    627 B
    5
    5

    HTTP Request

    POST http://lygynud.com/login.php

    HTTP Response

    200
  • 104.21.16.1:443
    https://lysyvan.com/login.php
    tls, http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    1.9kB
    50.9kB
    28
    45

    HTTP Request

    GET https://lysyvan.com/login.php

    HTTP Response

    404
  • 47.102.219.3:8000
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    3
  • 104.21.16.1:443
    https://lysyvan.com/login.php
    tls, http
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    2.7kB
    51.0kB
    46
    48

    HTTP Request

    GET https://lysyvan.com/login.php

    HTTP Response

    404
  • 47.102.219.3:8000
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    152 B
    3
  • 47.102.219.3:8000
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    52 B
    1
  • 8.8.8.8:53
    gatyfus.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    185 B
    3
    1

    DNS Request

    gatyfus.com

    DNS Request

    gatyfus.com

    DNS Request

    gatyfus.com

    DNS Response

    5.79.71.225
    178.162.203.226
    178.162.203.211
    178.162.203.202
    178.162.217.107
    5.79.71.205
    85.17.31.122
    85.17.31.82

  • 8.8.8.8:53
    vojyqem.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    vojyqem.com

    DNS Request

    vojyqem.com

    DNS Request

    vojyqem.com

  • 8.8.8.8:53
    puvyxil.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    puvyxil.com

    DNS Request

    puvyxil.com

    DNS Request

    puvyxil.com

  • 8.8.8.8:53
    lyryfyd.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    lyryfyd.com

    DNS Request

    lyryfyd.com

    DNS Request

    lyryfyd.com

  • 8.8.8.8:53
    qegyqaq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    qegyqaq.com

    DNS Request

    qegyqaq.com

    DNS Request

    qegyqaq.com

  • 8.8.8.8:53
    gacyzuz.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    gacyzuz.com

    DNS Request

    gacyzuz.com

    DNS Request

    gacyzuz.com

  • 8.8.8.8:53
    vowydef.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    vowydef.com

    DNS Request

    vowydef.com

    DNS Request

    vowydef.com

  • 8.8.8.8:53
    pufymoq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    pufymoq.com

    DNS Request

    pufymoq.com

    DNS Request

    pufymoq.com

  • 8.8.8.8:53
    lyxylux.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    lyxylux.com

    DNS Request

    lyxylux.com

    DNS Request

    lyxylux.com

  • 8.8.8.8:53
    qeqysag.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    qeqysag.com

    DNS Request

    qeqysag.com

    DNS Request

    qeqysag.com

  • 8.8.8.8:53
    gadyniw.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    73 B
    3
    1

    DNS Request

    gadyniw.com

    DNS Request

    gadyniw.com

    DNS Request

    gadyniw.com

    DNS Response

    154.212.231.82

  • 8.8.8.8:53
    volykyc.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    volykyc.com

    DNS Request

    volykyc.com

    DNS Request

    volykyc.com

  • 8.8.8.8:53
    pumypog.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    pumypog.com

    DNS Request

    pumypog.com

    DNS Request

    pumypog.com

  • 8.8.8.8:53
    lysynur.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    lysynur.com

    DNS Request

    lysynur.com

    DNS Request

    lysynur.com

  • 8.8.8.8:53
    qekykev.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    qekykev.com

    DNS Request

    qekykev.com

    DNS Request

    qekykev.com

  • 8.8.8.8:53
    ganypih.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    ganypih.com

    DNS Request

    ganypih.com

    DNS Request

    ganypih.com

  • 8.8.8.8:53
    vopybyt.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    vopybyt.com

    DNS Request

    vopybyt.com

    DNS Request

    vopybyt.com

  • 8.8.8.8:53
    pujyjav.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    pujyjav.com

    DNS Request

    pujyjav.com

    DNS Request

    pujyjav.com

  • 8.8.8.8:53
    lyvytuj.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    lyvytuj.com

    DNS Request

    lyvytuj.com

    DNS Request

    lyvytuj.com

  • 8.8.8.8:53
    qetyvep.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    qetyvep.com

    DNS Request

    qetyvep.com

    DNS Request

    qetyvep.com

  • 8.8.8.8:53
    gahyhob.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    gahyhob.com

    DNS Request

    gahyhob.com

    DNS Request

    gahyhob.com

  • 8.8.8.8:53
    vocyruk.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    vocyruk.com

    DNS Request

    vocyruk.com

    DNS Request

    vocyruk.com

  • 8.8.8.8:53
    purycap.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    purycap.com

    DNS Request

    purycap.com

    DNS Request

    purycap.com

  • 8.8.8.8:53
    lygygin.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    lygygin.com

    DNS Request

    lygygin.com

    DNS Request

    lygygin.com

  • 8.8.8.8:53
    qexyryl.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    qexyryl.com

    DNS Request

    qexyryl.com

    DNS Request

    qexyryl.com

  • 8.8.8.8:53
    gaqycos.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    gaqycos.com

    DNS Request

    gaqycos.com

    DNS Request

    gaqycos.com

  • 8.8.8.8:53
    vofygum.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    vofygum.com

    DNS Request

    vofygum.com

    DNS Request

    vofygum.com

  • 8.8.8.8:53
    puzywel.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    puzywel.com

    DNS Request

    puzywel.com

    DNS Request

    puzywel.com

  • 8.8.8.8:53
    lymyxid.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    73 B
    3
    1

    DNS Request

    lymyxid.com

    DNS Request

    lymyxid.com

    DNS Request

    lymyxid.com

    DNS Response

    3.94.10.34

  • 8.8.8.8:53
    qedyfyq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    285 B
    130 B
    5
    1

    DNS Request

    qedyfyq.com

    DNS Request

    qedyfyq.com

    DNS Request

    qedyfyq.com

    DNS Request

    qedyfyq.com

    DNS Request

    qedyfyq.com

  • 8.8.8.8:53
    galyqaz.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    73 B
    3
    1

    DNS Request

    galyqaz.com

    DNS Request

    galyqaz.com

    DNS Request

    galyqaz.com

    DNS Response

    199.191.50.83

  • 8.8.8.8:53
    vonyzuf.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    vonyzuf.com

    DNS Request

    vonyzuf.com

    DNS Request

    vonyzuf.com

  • 8.8.8.8:53
    qetyfuv.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    73 B
    3
    1

    DNS Request

    qetyfuv.com

    DNS Request

    qetyfuv.com

    DNS Request

    qetyfuv.com

    DNS Response

    44.221.84.105

  • 8.8.8.8:53
    gahyqah.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    89 B
    3
    1

    DNS Request

    gahyqah.com

    DNS Request

    gahyqah.com

    DNS Request

    gahyqah.com

    DNS Response

    23.253.46.64
    162.255.119.102

  • 8.8.8.8:53
    vocyzit.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    285 B
    73 B
    5
    1

    DNS Request

    vocyzit.com

    DNS Request

    vocyzit.com

    DNS Request

    vocyzit.com

    DNS Request

    vocyzit.com

    DNS Request

    vocyzit.com

    DNS Response

    44.221.84.105

  • 8.8.8.8:53
    purydyv.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    purydyv.com

    DNS Request

    purydyv.com

    DNS Request

    purydyv.com

  • 8.8.8.8:53
    lygymoj.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    lygymoj.com

    DNS Request

    lygymoj.com

    DNS Request

    lygymoj.com

  • 8.8.8.8:53
    qexylup.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    qexylup.com

    DNS Request

    qexylup.com

    DNS Request

    qexylup.com

  • 8.8.8.8:53
    gaqydeb.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    gaqydeb.com

    DNS Request

    gaqydeb.com

    DNS Request

    gaqydeb.com

  • 8.8.8.8:53
    vofymik.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    285 B
    130 B
    5
    1

    DNS Request

    vofymik.com

    DNS Request

    vofymik.com

    DNS Request

    vofymik.com

    DNS Request

    vofymik.com

    DNS Request

    vofymik.com

  • 8.8.8.8:53
    puzylyp.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    89 B
    3
    1

    DNS Request

    puzylyp.com

    DNS Request

    puzylyp.com

    DNS Request

    puzylyp.com

    DNS Response

    99.83.170.3
    75.2.71.199

  • 8.8.8.8:53
    lymysan.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    285 B
    130 B
    5
    1

    DNS Request

    lymysan.com

    DNS Request

    lymysan.com

    DNS Request

    lymysan.com

    DNS Request

    lymysan.com

    DNS Request

    lymysan.com

  • 8.8.8.8:53
    qedynul.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    qedynul.com

    DNS Request

    qedynul.com

    DNS Request

    qedynul.com

  • 8.8.8.8:53
    galykes.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    285 B
    130 B
    5
    1

    DNS Request

    galykes.com

    DNS Request

    galykes.com

    DNS Request

    galykes.com

    DNS Request

    galykes.com

    DNS Request

    galykes.com

  • 8.8.8.8:53
    vonypom.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    73 B
    3
    1

    DNS Request

    vonypom.com

    DNS Request

    vonypom.com

    DNS Request

    vonypom.com

    DNS Response

    34.227.7.138

  • 8.8.8.8:53
    pupybul.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    285 B
    130 B
    5
    1

    DNS Request

    pupybul.com

    DNS Request

    pupybul.com

    DNS Request

    pupybul.com

    DNS Request

    pupybul.com

    DNS Request

    pupybul.com

  • 8.8.8.8:53
    lykyjad.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    lykyjad.com

    DNS Request

    lykyjad.com

    DNS Request

    lykyjad.com

  • 8.8.8.8:53
    qebytiq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    285 B
    130 B
    5
    1

    DNS Request

    qebytiq.com

    DNS Request

    qebytiq.com

    DNS Request

    qebytiq.com

    DNS Request

    qebytiq.com

    DNS Request

    qebytiq.com

  • 8.8.8.8:53
    gatyvyz.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    gatyvyz.com

    DNS Request

    gatyvyz.com

    DNS Request

    gatyvyz.com

  • 8.8.8.8:53
    vojyjof.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    228 B
    130 B
    4
    1

    DNS Request

    vojyjof.com

    DNS Request

    vojyjof.com

    DNS Request

    vojyjof.com

    DNS Request

    vojyjof.com

  • 8.8.8.8:53
    puvytuq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    130 B
    3
    1

    DNS Request

    puvytuq.com

    DNS Request

    puvytuq.com

    DNS Request

    puvytuq.com

  • 8.8.8.8:53
    lyryvex.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    lyryvex.com

    DNS Request

    lyryvex.com

  • 8.8.8.8:53
    qegyhig.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    169 B
    2
    1

    DNS Request

    qegyhig.com

    DNS Request

    qegyhig.com

    DNS Response

    104.21.16.1
    104.21.96.1
    104.21.64.1
    104.21.112.1
    104.21.48.1
    104.21.80.1
    104.21.32.1

  • 8.8.8.8:53
    gacyryw.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    gacyryw.com

    DNS Request

    gacyryw.com

  • 8.8.8.8:53
    vowycac.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    vowycac.com

    DNS Request

    vowycac.com

  • 8.8.8.8:53
    pufygug.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    pufygug.com

    DNS Request

    pufygug.com

  • 8.8.8.8:53
    lyxywer.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    lyxywer.com

    DNS Request

    lyxywer.com

  • 8.8.8.8:53
    qeqyxov.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    qeqyxov.com

    DNS Request

    qeqyxov.com

  • 8.8.8.8:53
    gadyfuh.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    gadyfuh.com

    DNS Request

    gadyfuh.com

  • 8.8.8.8:53
    volyqat.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    volyqat.com

    DNS Request

    volyqat.com

  • 8.8.8.8:53
    pumyxiv.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    pumyxiv.com

    DNS Request

    pumyxiv.com

  • 8.8.8.8:53
    lysyfyj.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    57 B
    2
    1

    DNS Request

    lysyfyj.com

    DNS Request

    lysyfyj.com

  • 8.8.8.8:53
    qekyqop.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    qekyqop.com

    DNS Request

    qekyqop.com

  • 8.8.8.8:53
    lyvyxor.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    57 B
    2
    1

    DNS Request

    lyvyxor.com

    DNS Request

    lyvyxor.com

  • 8.8.8.8:53
    qegyhig.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    169 B
    1
    1

    DNS Request

    qegyhig.com

    DNS Response

    104.21.112.1
    104.21.64.1
    104.21.80.1
    104.21.48.1
    104.21.96.1
    104.21.16.1
    104.21.32.1

  • 8.8.8.8:53
    gatyfus.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    185 B
    1
    1

    DNS Request

    gatyfus.com

    DNS Response

    85.17.31.122
    178.162.203.202
    178.162.217.107
    178.162.203.226
    178.162.203.211
    85.17.31.82
    5.79.71.225
    5.79.71.205

  • 8.8.8.8:53
    puzylyp.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    89 B
    1
    1

    DNS Request

    puzylyp.com

    DNS Response

    99.83.170.3
    75.2.71.199

  • 8.8.8.8:53
    gahyqah.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    89 B
    3
    1

    DNS Request

    gahyqah.com

    DNS Request

    gahyqah.com

    DNS Request

    gahyqah.com

    DNS Response

    162.255.119.102
    23.253.46.64

  • 8.8.8.8:53
    lymyxid.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    73 B
    1
    1

    DNS Request

    lymyxid.com

    DNS Response

    3.94.10.34

  • 8.8.8.8:53
    qetyfuv.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    73 B
    1
    1

    DNS Request

    qetyfuv.com

    DNS Response

    44.221.84.105

  • 8.8.8.8:53
    vonypom.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    73 B
    1
    1

    DNS Request

    vonypom.com

    DNS Response

    34.227.7.138

  • 8.8.8.8:53
    galyqaz.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    73 B
    1
    1

    DNS Request

    galyqaz.com

    DNS Response

    199.191.50.83

  • 8.8.8.8:53
    gadyniw.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    171 B
    73 B
    3
    1

    DNS Request

    gadyniw.com

    DNS Request

    gadyniw.com

    DNS Request

    gadyniw.com

    DNS Response

    154.212.231.82

  • 8.8.8.8:53
    www.gahyqah.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    61 B
    113 B
    1
    1

    DNS Request

    www.gahyqah.com

    DNS Response

    91.195.240.19

  • 8.8.8.8:53
    vocyzit.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    73 B
    1
    1

    DNS Request

    vocyzit.com

    DNS Response

    44.221.84.105

  • 8.8.8.8:53
    c.pki.goog
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    56 B
    107 B
    1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.178.3

  • 8.8.8.8:53
    crl.microsoft.com
    dns
    63 B
    162 B
    1
    1

    DNS Request

    crl.microsoft.com

    DNS Response

    2.19.252.157
    2.19.252.143

  • 8.8.8.8:53
    www.microsoft.com
    dns
    63 B
    230 B
    1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    104.121.237.231

  • 8.8.8.8:53
    ganyzub.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    ganyzub.com

  • 8.8.8.8:53
    vopydek.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    vopydek.com

  • 8.8.8.8:53
    pujymip.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    pujymip.com

  • 8.8.8.8:53
    lyvylyn.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    lyvylyn.com

  • 8.8.8.8:53
    gahynus.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gahynus.com

  • 8.8.8.8:53
    qetysal.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qetysal.com

  • 8.8.8.8:53
    vocykem.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    vocykem.com

  • 8.8.8.8:53
    purypol.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    purypol.com

  • 8.8.8.8:53
    lygynud.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    73 B
    1
    1

    DNS Request

    lygynud.com

    DNS Response

    3.94.10.34

  • 8.8.8.8:53
    qexykaq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qexykaq.com

  • 8.8.8.8:53
    gaqypiz.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gaqypiz.com

  • 8.8.8.8:53
    vofybyf.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    vofybyf.com

  • 8.8.8.8:53
    puzyjoq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    puzyjoq.com

  • 8.8.8.8:53
    lymytux.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    lymytux.com

  • 8.8.8.8:53
    qedyveg.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qedyveg.com

  • 8.8.8.8:53
    galyhiw.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    galyhiw.com

  • 8.8.8.8:53
    vonyryc.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    vonyryc.com

  • 8.8.8.8:53
    lykymox.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    lykymox.com

  • 8.8.8.8:53
    pupycag.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    73 B
    1
    1

    DNS Request

    pupycag.com

    DNS Response

    34.227.7.138

  • 8.8.8.8:53
    lykygur.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    lykygur.com

  • 8.8.8.8:53
    qebylug.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qebylug.com

  • 8.8.8.8:53
    qebyrev.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qebyrev.com

  • 8.8.8.8:53
    gatycoh.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gatycoh.com

  • 8.8.8.8:53
    gatydaw.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gatydaw.com

  • 8.8.8.8:53
    vojygut.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    vojygut.com

  • 8.8.8.8:53
    puvywav.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    puvywav.com

  • 8.8.8.8:53
    puvylyg.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    puvylyg.com

  • 8.8.8.8:53
    lyryxij.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    lyryxij.com

  • 8.8.8.8:53
    vojymic.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    vojymic.com

  • 8.8.8.8:53
    qegyfyp.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qegyfyp.com

  • 8.8.8.8:53
    gacyqob.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gacyqob.com

  • 8.8.8.8:53
    lyrysor.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    133 B
    1
    1

    DNS Request

    lyrysor.com

    DNS Response

    172.233.130.182

  • 8.8.8.8:53
    vowyzuk.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    vowyzuk.com

  • 8.8.8.8:53
    pufydep.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    pufydep.com

  • 8.8.8.8:53
    qegynuv.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qegynuv.com

  • 8.8.8.8:53
    lyxymin.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    lyxymin.com

  • 8.8.8.8:53
    qeqylyl.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qeqylyl.com

  • 8.8.8.8:53
    gacykeh.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gacykeh.com

  • 8.8.8.8:53
    gadydas.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gadydas.com

  • 8.8.8.8:53
    volymum.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    volymum.com

  • 8.8.8.8:53
    vowypit.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    vowypit.com

  • 8.8.8.8:53
    pufybyv.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    pufybyv.com

  • 8.8.8.8:53
    lyxyjaj.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    lyxyjaj.com

    DNS Request

    lyxyjaj.com

  • 8.8.8.8:53
    qeqytup.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    qeqytup.com

    DNS Request

    qeqytup.com

  • 8.8.8.8:53
    gadyveb.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gadyveb.com

  • 8.8.8.8:53
    volyjok.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    volyjok.com

  • 8.8.8.8:53
    pumytup.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    pumytup.com

  • 8.8.8.8:53
    lysyvan.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    169 B
    1
    1

    DNS Request

    lysyvan.com

    DNS Response

    104.21.96.1
    104.21.80.1
    104.21.64.1
    104.21.112.1
    104.21.48.1
    104.21.32.1
    104.21.16.1

  • 8.8.8.8:53
    qekyhil.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qekyhil.com

  • 8.8.8.8:53
    ganyrys.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    ganyrys.com

  • 8.8.8.8:53
    vopycom.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    vopycom.com

  • 8.8.8.8:53
    pujygul.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    pujygul.com

  • 8.8.8.8:53
    lyvywed.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    lyvywed.com

  • 8.8.8.8:53
    qetyxiq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qetyxiq.com

  • 8.8.8.8:53
    gahyfyz.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gahyfyz.com

  • 8.8.8.8:53
    puryxuq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    puryxuq.com

  • 8.8.8.8:53
    lygyfex.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    lygyfex.com

  • 8.8.8.8:53
    pupydeq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    89 B
    1
    1

    DNS Request

    pupydeq.com

    DNS Response

    13.248.169.48
    76.223.54.146

  • 8.8.8.8:53
    qexyqog.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    qexyqog.com

  • 8.8.8.8:53
    gaqyzuw.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    gaqyzuw.com

  • 8.8.8.8:53
    vofydac.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    114 B
    130 B
    2
    1

    DNS Request

    vofydac.com

    DNS Request

    vofydac.com

  • 8.8.8.8:53
    puzymig.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    puzymig.com

  • 8.8.8.8:53
    lymylyr.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    130 B
    1
    1

    DNS Request

    lymylyr.com

  • 8.8.8.8:53
    pupydeq.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    89 B
    1
    1

    DNS Request

    pupydeq.com

    DNS Response

    76.223.54.146
    13.248.169.48

  • 8.8.8.8:53
    lysyvan.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    169 B
    1
    1

    DNS Request

    lysyvan.com

    DNS Response

    104.21.16.1
    104.21.80.1
    104.21.64.1
    104.21.48.1
    104.21.32.1
    104.21.96.1
    104.21.112.1

  • 8.8.8.8:53
    pupycag.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    73 B
    1
    1

    DNS Request

    pupycag.com

    DNS Response

    34.227.7.138

  • 8.8.8.8:53
    lygynud.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    73 B
    1
    1

    DNS Request

    lygynud.com

    DNS Response

    3.94.10.34

  • 8.8.8.8:53
    lyrysor.com
    dns
    JaffaCakes118_d23262938f92e3b274f2ed4eecffc25e.exe
    57 B
    133 B
    1
    1

    DNS Request

    lyrysor.com

    DNS Response

    172.233.130.182

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1940-0-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/1940-1-0x0000000000360000-0x00000000003B8000-memory.dmp

    Filesize

    352KB

  • memory/1940-2-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/1940-4-0x0000000002960000-0x0000000002A14000-memory.dmp

    Filesize

    720KB

  • memory/1940-14-0x0000000002960000-0x0000000002A14000-memory.dmp

    Filesize

    720KB

  • memory/1940-12-0x0000000002960000-0x0000000002A14000-memory.dmp

    Filesize

    720KB

  • memory/1940-10-0x0000000002960000-0x0000000002A14000-memory.dmp

    Filesize

    720KB

  • memory/1940-9-0x0000000002960000-0x0000000002A14000-memory.dmp

    Filesize

    720KB

  • memory/1940-6-0x0000000002960000-0x0000000002A14000-memory.dmp

    Filesize

    720KB

  • memory/1940-15-0x0000000000400000-0x0000000000662000-memory.dmp

    Filesize

    2.4MB

  • memory/1940-16-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-21-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-20-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-18-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-56-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-54-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-55-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-57-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-73-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-58-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-89-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-59-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-99-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-98-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-97-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-96-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-95-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-94-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-93-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-92-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-91-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-90-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-88-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-87-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-86-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-85-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-84-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-83-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-82-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-81-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-80-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-79-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-78-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-77-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-76-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-75-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-74-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-72-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-71-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-70-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-69-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-68-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-67-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-66-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-65-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-64-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-63-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-62-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-61-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-60-0x0000000002C70000-0x0000000002D33000-memory.dmp

    Filesize

    780KB

  • memory/1940-166-0x0000000000360000-0x00000000003B8000-memory.dmp

    Filesize

    352KB

  • memory/1940-170-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.