Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

3D Analyze...ze.exe

windows7-x64

1

3D Analyze...ze.exe

windows10-2004-x64

1

3D Analyze...LL.dll

windows7-x64

1

3D Analyze...LL.dll

windows10-2004-x64

1

3D Analyze...t1.dll

windows7-x64

1

3D Analyze...t1.dll

windows10-2004-x64

1

3D Analyze...t2.dll

windows7-x64

1

3D Analyze...t2.dll

windows10-2004-x64

1

3D Analyze...t3.dll

windows7-x64

1

3D Analyze...t3.dll

windows10-2004-x64

1

3D Analyze...p.html

windows7-x64

1

3D Analyze...p.html

windows10-2004-x64

1

3D Analyze...da.htm

windows7-x64

1

3D Analyze...da.htm

windows10-2004-x64

1

3D Analyze...001.js

windows7-x64

1

3D Analyze...001.js

windows10-2004-x64

1

3D Analyze.../mc.js

windows7-x64

1

3D Analyze.../mc.js

windows10-2004-x64

1

3D Analyze...ll.htm

windows7-x64

1

3D Analyze...ll.htm

windows10-2004-x64

1

3D Analyze...k2.htm

windows7-x64

1

3D Analyze...k2.htm

windows10-2004-x64

1

3D Analyze...DA.dll

windows7-x64

1

3D Analyze...DA.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    132s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2023, 20:19 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3D Analyzer 2.37/3D Analyze/help_files/ts_back2.htm

  • Size

    3KB

  • MD5

    f445f5db00df518f24dff0baae1d22a9

  • SHA1

    e2515df492fd1201bfed481b3ddbc7f07eb9e6ee

  • SHA256

    0e539a7661773583fdbb07f17b99694964429c45484ae7062e097cf74a3f06b6

  • SHA512

    d3ef3fdb15e06d3d0873a9262b84dba633a682d2df187cf2aae2e130f35aaf69ba3fc83d55aa5dafbad27c38ccc9d4927e410ce0e696383a45c73d0fd8669943

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\3D Analyzer 2.37\3D Analyze\help_files\ts_back2.htm"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3360
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3360 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2776

Network

  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    1.208.79.178.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    1.208.79.178.in-addr.arpa
    IN PTR
    Response
    1.208.79.178.in-addr.arpa
    IN PTR
    https-178-79-208-1amsllnwnet
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    pic.geocities.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    pic.geocities.com
    IN A
    Response
  • flag-us
    DNS
    ar.yimg.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    ar.yimg.com
    IN A
    Response
  • flag-us
    DNS
    geo.yahoo.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    geo.yahoo.com
    IN A
    Response
    geo.yahoo.com
    IN CNAME
    geo-atsv2.media.g03.yahoodns.net
    geo-atsv2.media.g03.yahoodns.net
    IN A
    188.125.72.139
  • flag-ie
    GET
    http://geo.yahoo.com/serv?s=19190039&t=1221019631&f=ar-w82
    IEXPLORE.EXE
    Remote address:
    188.125.72.139:80
    Request
    GET /serv?s=19190039&t=1221019631&f=ar-w82 HTTP/1.1
    Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: geo.yahoo.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    date: Tue, 10 Oct 2023 20:23:47 GMT
    p3p: policyref="https://policies.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
    set-cookie: B=79219aliibcmj&b=3&s=0u; expires=Wed, 09-Oct-2024 20:23:47 GMT; path=/; domain=.yahoo.com; secure
    cache-control: no-cache, no-store, private
    pragma: no-cache
    content-length: 43
    content-type: image/gif
    x-envoy-upstream-service-time: 0
    server: ATS
    Age: 0
    Connection: keep-alive
  • flag-us
    DNS
    57.169.31.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    57.169.31.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    139.72.125.188.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    139.72.125.188.in-addr.arpa
    IN PTR
    Response
    139.72.125.188.in-addr.arpa
    IN PTR
    media-router-brb71prodmediavipir2yahoocom
  • flag-us
    DNS
    us.adserver.yahoo.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    us.adserver.yahoo.com
    IN A
    Response
    us.adserver.yahoo.com
    IN CNAME
    global.adserver.yahoo.com
    global.adserver.yahoo.com
    IN CNAME
    facglobalsplitroute.gapx.yahoodns.net
    facglobalsplitroute.gapx.yahoodns.net
    IN A
    27.123.42.204
    facglobalsplitroute.gapx.yahoodns.net
    IN A
    27.123.42.205
  • flag-in
    GET
    http://us.adserver.yahoo.com/a?f=76001284&p=geocities&l=E&c=sh&bg=white
    IEXPLORE.EXE
    Remote address:
    27.123.42.204:80
    Request
    GET /a?f=76001284&p=geocities&l=E&c=sh&bg=white HTTP/1.1
    Accept: text/html, application/xhtml+xml, image/jxr, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: us.adserver.yahoo.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Content-Type: text/html; charset=utf-8
    Pragma: no-cache
    Expires: 0
    Cache-Control: private, no-store, max-age=0
    Content-Length: 1463
    X-ATS-Disc-Connection: 127.0.0.1:9090
    X-ATS-DiscPlugin-Version: 2.2.4.0
    Date: Tue, 10 Oct 2023 20:23:49 GMT
    Age: 0
    Server: ATS
    Referrer-Policy: no-referrer-when-downgrade
    Connection: keep-alive
  • flag-us
    DNS
    aka-cdn.adtechus.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    aka-cdn.adtechus.com
    IN A
    Response
    aka-cdn.adtechus.com
    IN CNAME
    cs704.wpc.thetacdn.net
    cs704.wpc.thetacdn.net
    IN CNAME
    cs701.lb.wpc.apr-1b09e.edgecastdns.net
    cs701.lb.wpc.apr-1b09e.edgecastdns.net
    IN CNAME
    cs1697.wpc.thetacdn.net
    cs1697.wpc.thetacdn.net
    IN A
    152.199.6.11
  • flag-us
    GET
    https://aka-cdn.adtechus.com/images/ATCollapse.gif
    IEXPLORE.EXE
    Remote address:
    152.199.6.11:443
    Request
    GET /images/ATCollapse.gif HTTP/2.0
    host: aka-cdn.adtechus.com
    accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    referer: http://us.adserver.yahoo.com/a?f=76001284&p=geocities&l=E&c=sh&bg=white
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 200
    accept-ranges: bytes
    age: 483650
    content-type: image/gif
    date: Tue, 10 Oct 2023 20:23:49 GMT
    etag: "df3e567d6f16d040326c7a0ea29a4f41"
    last-modified: Thu, 06 Sep 2018 13:41:08 GMT
    server: ECAcc (bsb/27B6)
    x-amz-id-2: Y+00iyDZbfUh+6lcEUyfRBnU5Rn6DfnbGd1dWPgVNimyH9rSGzdxIh7Y0ULsezbQtV7bWjGrSCDDg/4ue4WtcA==
    x-amz-request-id: ZJ0496HBS2KFZZP1
    x-amz-server-side-encryption: AES256
    x-cache: HIT
    content-length: 43
  • flag-us
    DNS
    12.ras.yahoo.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    12.ras.yahoo.com
    IN A
    Response
    12.ras.yahoo.com
    IN CNAME
    edge.gycpi.b.yahoodns.net
    edge.gycpi.b.yahoodns.net
    IN A
    87.248.116.12
    edge.gycpi.b.yahoodns.net
    IN A
    87.248.116.11
  • flag-nl
    GET
    https://12.ras.yahoo.com/adcount%7C2.0%7C5113.1%7C221794%7C0%7C16%7CAdId=-3;BnId=0;ct=2080709675;st=9299;adcid=1;itime=969429742;reqtype=5;;impref=1696969429197045;imprefseq=13523993357226554;imprefts=1696969429;adclntid=1004;spaceid=76001284;adposition=E;lmsid=;revshare=;pvid=VufyxgAAAADL8pzkhCIjJRQXG3sqy2UlstUAAnPQ;sectionid=;kvpgcolo=sg3;kvssp=ssp;kvmn=y100000;kvadtc_dvmktname=unknown;kvadtc_dvosplt=windows_10;kvadtc_dvbrand=microsoft;kvadtc_dvtype=desktop;kvadtc_dvmodel=internet_explorer_-_windows;kvrepo_dvosplt=windows_10;kvadtc_dvosversion=NT%2010.0;kvadtc_crmcc=UNKNOWN;kvadtc_crmnc=UNKNOWN;gdpr=0;
    IEXPLORE.EXE
    Remote address:
    87.248.116.12:443
    Request
    GET /adcount%7C2.0%7C5113.1%7C221794%7C0%7C16%7CAdId=-3;BnId=0;ct=2080709675;st=9299;adcid=1;itime=969429742;reqtype=5;;impref=1696969429197045;imprefseq=13523993357226554;imprefts=1696969429;adclntid=1004;spaceid=76001284;adposition=E;lmsid=;revshare=;pvid=VufyxgAAAADL8pzkhCIjJRQXG3sqy2UlstUAAnPQ;sectionid=;kvpgcolo=sg3;kvssp=ssp;kvmn=y100000;kvadtc_dvmktname=unknown;kvadtc_dvosplt=windows_10;kvadtc_dvbrand=microsoft;kvadtc_dvtype=desktop;kvadtc_dvmodel=internet_explorer_-_windows;kvrepo_dvosplt=windows_10;kvadtc_dvosversion=NT%2010.0;kvadtc_crmcc=UNKNOWN;kvadtc_crmnc=UNKNOWN;gdpr=0; HTTP/2.0
    host: 12.ras.yahoo.com
    accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
    referer: http://us.adserver.yahoo.com/a?f=76001284&p=geocities&l=E&c=sh&bg=white
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    cookie: B=79219aliibcmj&b=3&s=0u
    Response
    HTTP/2.0 200
    date: Tue, 10 Oct 2023 20:23:50 GMT
    content-type: application/x-javascript
    content-length: 1
    server: ATS
    expires: Mon, 15 Jun 1998 00:00:00 GMT
    pragma: no-cache
    cache-control: no-store, no-cache
    referrer-policy: no-referrer-when-downgrade
    age: 3
    strict-transport-security: max-age=31536000
    expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
    x-xss-protection: 1; mode=block
    x-content-type-options: nosniff
    set-cookie: A3=d=AQABBNWyJWUCEGYD8N24u1BcaoSBiyf0tgEFEgEBAQEEJ2UvZe2LzSMA_eMAAA&S=AQAAApXW1WHfMpZLfmDDFXMZ-Qo; Expires=Thu, 10 Oct 2024 02:23:51 GMT; Max-Age=31557600; Domain=.yahoo.com; Path=/; SameSite=None; Secure; HttpOnly
  • flag-us
    DNS
    204.42.123.27.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    204.42.123.27.in-addr.arpa
    IN PTR
    Response
    204.42.123.27.in-addr.arpa
    IN PTR
    e1-haycpiinayahoocom
  • flag-us
    DNS
    11.6.199.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.6.199.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    12.116.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    12.116.248.87.in-addr.arpa
    IN PTR
    Response
    12.116.248.87.in-addr.arpa
    IN PTR
    e2ycpivipambyahoocom
  • flag-us
    DNS
    158.240.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    158.240.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    77.121.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.121.18.2.in-addr.arpa
    IN PTR
    Response
    77.121.18.2.in-addr.arpa
    IN PTR
    a2-18-121-77deploystaticakamaitechnologiescom
  • flag-us
    DNS
    200.81.21.72.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.81.21.72.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301594_16P5W3HNTIETE3DL8&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301594_16P5W3HNTIETE3DL8&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 370889
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 8A393DAAF626415A94DF32764F205A77 Ref B: BRU30EDGE0811 Ref C: 2023-10-10T20:24:25Z
    date: Tue, 10 Oct 2023 20:24:25 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301185_111IP3CQWIM3YFJP7&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301185_111IP3CQWIM3YFJP7&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 380848
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 92C8CB24A5994087BB41C5A5A08B54A7 Ref B: BRU30EDGE0811 Ref C: 2023-10-10T20:24:25Z
    date: Tue, 10 Oct 2023 20:24:25 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301446_1EN88Z1GJDY90F0IF&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301446_1EN88Z1GJDY90F0IF&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 344167
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 24A3285AA7464F72A40594E653AC6D9C Ref B: BRU30EDGE0811 Ref C: 2023-10-10T20:24:25Z
    date: Tue, 10 Oct 2023 20:24:25 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301013_1R2AO9YZ4I5BGB4K2&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301013_1R2AO9YZ4I5BGB4K2&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 350429
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 87979E22F2AF4786AF3518B6A04DAA8E Ref B: BRU30EDGE0811 Ref C: 2023-10-10T20:24:25Z
    date: Tue, 10 Oct 2023 20:24:25 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317300937_1HHU6SR72RIO6JU61&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317300937_1HHU6SR72RIO6JU61&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 373128
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 8A63EE675B2B463DBB7798E82F768C2E Ref B: BRU30EDGE0811 Ref C: 2023-10-10T20:24:25Z
    date: Tue, 10 Oct 2023 20:24:25 GMT
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    8.3.197.209.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.3.197.209.in-addr.arpa
    IN PTR
    Response
    8.3.197.209.in-addr.arpa
    IN PTR
    vip0x008map2sslhwcdnnet
  • flag-us
    DNS
    9.179.89.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.179.89.13.in-addr.arpa
    IN PTR
    Response
  • 188.125.72.139:80
    http://geo.yahoo.com/serv?s=19190039&t=1221019631&f=ar-w82
    http
    IEXPLORE.EXE
    862 B
     790 B
     12
    4

    HTTP Request

    GET http://geo.yahoo.com/serv?s=19190039&t=1221019631&f=ar-w82

    HTTP Response

    200
  • 188.125.72.139:80
    geo.yahoo.com
    IEXPLORE.EXE
    242 B
     184 B
     5
    4
  • 27.123.42.204:80
    us.adserver.yahoo.com
    IEXPLORE.EXE
    236 B
     136 B
     5
    3
  • 27.123.42.204:80
    http://us.adserver.yahoo.com/a?f=76001284&p=geocities&l=E&c=sh&bg=white
    http
    IEXPLORE.EXE
    632 B
     2.1kB
     7
    6

    HTTP Request

    GET http://us.adserver.yahoo.com/a?f=76001284&p=geocities&l=E&c=sh&bg=white

    HTTP Response

    200
  • 152.199.6.11:443
    https://aka-cdn.adtechus.com/images/ATCollapse.gif
    tls, http2
    IEXPLORE.EXE
    1.4kB
     5.2kB
     15
    10

    HTTP Request

    GET https://aka-cdn.adtechus.com/images/ATCollapse.gif

    HTTP Response

    200
  • 152.199.6.11:443
    aka-cdn.adtechus.com
    tls, http2
    IEXPLORE.EXE
    1.2kB
     5.0kB
     16
    13
  • 87.248.116.12:443
    https://12.ras.yahoo.com/adcount%7C2.0%7C5113.1%7C221794%7C0%7C16%7CAdId=-3;BnId=0;ct=2080709675;st=9299;adcid=1;itime=969429742;reqtype=5;;impref=1696969429197045;imprefseq=13523993357226554;imprefts=1696969429;adclntid=1004;spaceid=76001284;adposition=E;lmsid=;revshare=;pvid=VufyxgAAAADL8pzkhCIjJRQXG3sqy2UlstUAAnPQ;sectionid=;kvpgcolo=sg3;kvssp=ssp;kvmn=y100000;kvadtc_dvmktname=unknown;kvadtc_dvosplt=windows_10;kvadtc_dvbrand=microsoft;kvadtc_dvtype=desktop;kvadtc_dvmodel=internet_explorer_-_windows;kvrepo_dvosplt=windows_10;kvadtc_dvosversion=NT%2010.0;kvadtc_crmcc=UNKNOWN;kvadtc_crmnc=UNKNOWN;gdpr=0;
    tls, http2
    IEXPLORE.EXE
    1.9kB
     6.2kB
     18
    13

    HTTP Request

    GET https://12.ras.yahoo.com/adcount%7C2.0%7C5113.1%7C221794%7C0%7C16%7CAdId=-3;BnId=0;ct=2080709675;st=9299;adcid=1;itime=969429742;reqtype=5;;impref=1696969429197045;imprefseq=13523993357226554;imprefts=1696969429;adclntid=1004;spaceid=76001284;adposition=E;lmsid=;revshare=;pvid=VufyxgAAAADL8pzkhCIjJRQXG3sqy2UlstUAAnPQ;sectionid=;kvpgcolo=sg3;kvssp=ssp;kvmn=y100000;kvadtc_dvmktname=unknown;kvadtc_dvosplt=windows_10;kvadtc_dvbrand=microsoft;kvadtc_dvtype=desktop;kvadtc_dvmodel=internet_explorer_-_windows;kvrepo_dvosplt=windows_10;kvadtc_dvosversion=NT%2010.0;kvadtc_crmcc=UNKNOWN;kvadtc_crmnc=UNKNOWN;gdpr=0;

    HTTP Response

    200
  • 87.248.116.12:443
    12.ras.yahoo.com
    tls, http2
    IEXPLORE.EXE
    1.1kB
     5.7kB
     16
    12
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317300937_1HHU6SR72RIO6JU61&pid=21.2&w=1920&h=1080&c=4
    tls, http2
    66.6kB
     1.7MB
     1249
    1268

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301594_16P5W3HNTIETE3DL8&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301185_111IP3CQWIM3YFJP7&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301446_1EN88Z1GJDY90F0IF&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301013_1R2AO9YZ4I5BGB4K2&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317300937_1HHU6SR72RIO6JU61&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     15
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.3kB
     15
    14
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
     8.3kB
     15
    14
  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    1.208.79.178.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    1.208.79.178.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    0.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    0.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    pic.geocities.com
    dns
    IEXPLORE.EXE
    63 B
     140 B
     1
    1

    DNS Request

    pic.geocities.com

  • 8.8.8.8:53
    ar.yimg.com
    dns
    IEXPLORE.EXE
    57 B
     134 B
     1
    1

    DNS Request

    ar.yimg.com

  • 8.8.8.8:53
    geo.yahoo.com
    dns
    IEXPLORE.EXE
    59 B
     121 B
     1
    1

    DNS Request

    geo.yahoo.com

    DNS Response

    188.125.72.139

  • 8.8.8.8:53
    57.169.31.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    57.169.31.20.in-addr.arpa

  • 8.8.8.8:53
    139.72.125.188.in-addr.arpa
    dns
    73 B
     134 B
     1
    1

    DNS Request

    139.72.125.188.in-addr.arpa

  • 8.8.8.8:53
    us.adserver.yahoo.com
    dns
    IEXPLORE.EXE
    67 B
     171 B
     1
    1

    DNS Request

    us.adserver.yahoo.com

    DNS Response

    27.123.42.204
    27.123.42.205

  • 8.8.8.8:53
    aka-cdn.adtechus.com
    dns
    IEXPLORE.EXE
    66 B
     188 B
     1
    1

    DNS Request

    aka-cdn.adtechus.com

    DNS Response

    152.199.6.11

  • 8.8.8.8:53
    12.ras.yahoo.com
    dns
    IEXPLORE.EXE
    62 B
     133 B
     1
    1

    DNS Request

    12.ras.yahoo.com

    DNS Response

    87.248.116.12
    87.248.116.11

  • 8.8.8.8:53
    204.42.123.27.in-addr.arpa
    dns
    72 B
     110 B
     1
    1

    DNS Request

    204.42.123.27.in-addr.arpa

  • 8.8.8.8:53
    11.6.199.152.in-addr.arpa
    dns
    71 B
     142 B
     1
    1

    DNS Request

    11.6.199.152.in-addr.arpa

  • 8.8.8.8:53
    12.116.248.87.in-addr.arpa
    dns
    72 B
     111 B
     1
    1

    DNS Request

    12.116.248.87.in-addr.arpa

  • 8.8.8.8:53
    158.240.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    158.240.127.40.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    77.121.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    77.121.18.2.in-addr.arpa

  • 8.8.8.8:53
    200.81.21.72.in-addr.arpa
    dns
    71 B
     142 B
     1
    1

    DNS Request

    200.81.21.72.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    8.3.197.209.in-addr.arpa
    dns
    70 B
     111 B
     1
    1

    DNS Request

    8.3.197.209.in-addr.arpa

  • 8.8.8.8:53
    9.179.89.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    9.179.89.13.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FTKK3XKB\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.