Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 11:42 UTC
Behavioral task
behavioral1
Sample
895c802177abbd362b58479798f1111c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
895c802177abbd362b58479798f1111c.exe
Resource
win10v2004-20231215-en
General
-
Target
895c802177abbd362b58479798f1111c.exe
-
Size
1003KB
-
MD5
895c802177abbd362b58479798f1111c
-
SHA1
2f432ec61a18ee555cc933622b43a4bdea0bd6e2
-
SHA256
2f8bbcd21805f0cb3e7b69ec9e5b4277885f403bf1d278ae6248965d2730ba79
-
SHA512
5bd16060fb4ab6a383406120eef6b55693fcc369c586bff39c88d667b4ca027a7b3f10548319a2917bd1cc6002133810e36a95e476127042fd4a66942871b014
-
SSDEEP
24576:aBE3RgOv7NT+70QagZ9PHJEuMlSVj21RaBkoXlq:CnOzNT+70Q3Z9PHJEuMlSVj21RaBkoXl
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3060 895c802177abbd362b58479798f1111c.exe -
Executes dropped EXE 1 IoCs
pid Process 3060 895c802177abbd362b58479798f1111c.exe -
resource yara_rule behavioral2/memory/4420-0-0x0000000000400000-0x000000000065C000-memory.dmp upx behavioral2/files/0x0007000000023209-12.dat upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 17 IoCs
pid pid_target Process procid_target 1096 3060 WerFault.exe 25 4476 3060 WerFault.exe 25 756 3060 WerFault.exe 25 220 3060 WerFault.exe 25 1184 3060 WerFault.exe 25 1348 3060 WerFault.exe 25 4960 3060 WerFault.exe 25 3116 3060 WerFault.exe 25 4652 3060 WerFault.exe 25 3360 3060 WerFault.exe 25 4988 3060 WerFault.exe 25 1096 3060 WerFault.exe 25 4476 3060 WerFault.exe 25 2352 3060 WerFault.exe 25 856 3060 WerFault.exe 25 2752 3060 WerFault.exe 25 4044 3060 WerFault.exe 25 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1524 schtasks.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 895c802177abbd362b58479798f1111c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 895c802177abbd362b58479798f1111c.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 895c802177abbd362b58479798f1111c.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405 895c802177abbd362b58479798f1111c.exe Set value (data) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\A053375BFE84E8B748782C7CEE15827A6AF5A405\Blob = 030000000100000014000000a053375bfe84e8b748782c7cee15827a6af5a405140000000100000014000000142eb317b75856cbae500940e61faf9d8b14c2c6040000000100000010000000e829e65d7c4307d6fbc13c179e037a360f0000000100000020000000444ebd67bb83f8807b3921e938ac9178b882bd50aadb11231f044cf5f08df7ce190000000100000010000000f044424c506513d62804c04f719403f95c0000000100000004000000000800001800000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000001a05000030820516308202fea003020102021100912b084acf0c18a753f6d62e25a75f5a300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a3032310b300906035504061302555331163014060355040a130d4c6574277320456e6372797074310b300906035504031302523330820122300d06092a864886f70d01010105000382010f003082010a0282010100bb021528ccf6a094d30f12ec8d5592c3f882f199a67a4288a75d26aab52bb9c54cb1af8e6bf975c8a3d70f4794145535578c9ea8a23919f5823c42a94e6ef53bc32edb8dc0b05cf35938e7edcf69f05a0b1bbec094242587fa3771b313e71cace19befdbe43b45524596a9c153ce34c852eeb5aeed8fde6070e2a554abb66d0e97a540346b2bd3bc66eb66347cfa6b8b8f572999f830175dba726ffb81c5add286583d17c7e709bbf12bf786dcc1da715dd446e3ccad25c188bc60677566b3f118f7a25ce653ff3a88b647a5ff1318ea9809773f9d53f9cf01e5f5a6701714af63a4ff99b3939ddc53a706fe48851da169ae2575bb13cc5203f5ed51a18bdb150203010001a382010830820104300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030206082b0601050507030130120603551d130101ff040830060101ff020100301d0603551d0e04160414142eb317b75856cbae500940e61faf9d8b14c2c6301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b0500038202010085ca4e473ea3f7854485bcd56778b29863ad754d1e963d336572542d81a0eac3edf820bf5fccb77000b76e3bf65e94dee4209fa6ef8bb203e7a2b5163c91ceb4ed3902e77c258a47e6656e3f46f4d9f0ce942bee54ce12bc8c274bb8c1982fa2afcd71914a08b7c8b8237b042d08f908573e83d904330a472178098227c32ac89bb9ce5cf264c8c0be79c04f8e6d440c5e92bb2ef78b10e1e81d4429db5920ed63b921f81226949357a01d6504c10a22ae100d4397a1181f7ee0e08637b55ab1bd30bf876e2b2aff214e1b05c3f51897f05eacc3a5b86af02ebc3b33b9ee4bdeccfce4af840b863fc0554336f668e136176a8e99d1ffa540a734b7c0d063393539756ef2ba76c89302e9a94b6c17ce0c02d9bd81fb9fb768d40665b3823d7753f88e7903ad0a3107752a43d8559772c4290ef7c45d4ec8ae468430d7f2855f18a179bbe75e708b07e18693c3b98fdc6171252aafdfed255052688b92dce5d6b5e3da7dd0876c842131ae82f5fbb9abc889173de14ce5380ef6bd2bbd968114ebd5db3d20a77e59d3e2f858f95bb848cdfe5c4f1629fe1e5523afc811b08dea7c9390172ffdaca20947463ff0e9b0b7ff284d6832d6675e1e69a393b8f59d8b2f0bd25243a66f3257654d3281df3853855d7e5d6629eab8dde495b5cdb5561242cdc44ec6253844506decce005518fee94964d44eca979cb45bc073a8abb847c2 895c802177abbd362b58479798f1111c.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 4420 895c802177abbd362b58479798f1111c.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 4420 895c802177abbd362b58479798f1111c.exe 3060 895c802177abbd362b58479798f1111c.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4420 wrote to memory of 3060 4420 895c802177abbd362b58479798f1111c.exe 25 PID 4420 wrote to memory of 3060 4420 895c802177abbd362b58479798f1111c.exe 25 PID 4420 wrote to memory of 3060 4420 895c802177abbd362b58479798f1111c.exe 25 PID 3060 wrote to memory of 1524 3060 895c802177abbd362b58479798f1111c.exe 29 PID 3060 wrote to memory of 1524 3060 895c802177abbd362b58479798f1111c.exe 29 PID 3060 wrote to memory of 1524 3060 895c802177abbd362b58479798f1111c.exe 29 PID 3060 wrote to memory of 1988 3060 895c802177abbd362b58479798f1111c.exe 37 PID 3060 wrote to memory of 1988 3060 895c802177abbd362b58479798f1111c.exe 37 PID 3060 wrote to memory of 1988 3060 895c802177abbd362b58479798f1111c.exe 37 PID 1988 wrote to memory of 1480 1988 cmd.exe 36 PID 1988 wrote to memory of 1480 1988 cmd.exe 36 PID 1988 wrote to memory of 1480 1988 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe"C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exeC:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\895c802177abbd362b58479798f1111c.exe" /TN xWvB9PLxff3d /F3⤵
- Creates scheduled task(s)
PID:1524
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN xWvB9PLxff3d > C:\Users\Admin\AppData\Local\Temp\RDs11.xml3⤵
- Suspicious use of WriteProcessMemory
PID:1988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 6163⤵
- Program crash
PID:1096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 6043⤵
- Program crash
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 7083⤵
- Program crash
PID:756
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 6563⤵
- Program crash
PID:220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 6563⤵
- Program crash
PID:1184
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 7403⤵
- Program crash
PID:1348
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 14643⤵
- Program crash
PID:4960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 19203⤵
- Program crash
PID:3116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 21443⤵
- Program crash
PID:4652
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 19363⤵
- Program crash
PID:3360
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 21403⤵
- Program crash
PID:4988
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 19203⤵
- Program crash
PID:1096
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 22003⤵
- Program crash
PID:4476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 21403⤵
- Program crash
PID:2352
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 21963⤵
- Program crash
PID:856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 21563⤵
- Program crash
PID:2752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 5683⤵
- Program crash
PID:4044
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3060 -ip 30601⤵PID:4744
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN xWvB9PLxff3d1⤵PID:1480
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3060 -ip 30601⤵PID:3676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3060 -ip 30601⤵PID:1572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3060 -ip 30601⤵PID:1440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3060 -ip 30601⤵PID:2628
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3060 -ip 30601⤵PID:4596
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3060 -ip 30601⤵PID:644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3060 -ip 30601⤵PID:4220
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3060 -ip 30601⤵PID:2296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3060 -ip 30601⤵PID:2008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3060 -ip 30601⤵PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3060 -ip 30601⤵PID:4508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 3060 -ip 30601⤵PID:4660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3060 -ip 30601⤵PID:1440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3060 -ip 30601⤵PID:3512
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3060 -ip 30601⤵PID:4364
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3060 -ip 30601⤵PID:2388
Network
-
Remote address:8.8.8.8:53Request19.53.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=1672E1DAA76A602A0BEAF22AA6D16179; domain=.bing.com; expires=Thu, 16-Jan-2025 14:44:09 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0ED7BDCBAA7941468013A2F8F5437F5F Ref B: LON04EDGE0913 Ref C: 2023-12-23T14:44:09Z
date: Sat, 23 Dec 2023 14:44:09 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1672E1DAA76A602A0BEAF22AA6D16179
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=o9-U92yCzqLlYv5qiqXudTHYI0pNTM5j9bswukn8NBI; domain=.bing.com; expires=Thu, 16-Jan-2025 14:44:10 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DD9E2797B3B2414A961E9799A63CE05E Ref B: LON04EDGE0913 Ref C: 2023-12-23T14:44:09Z
date: Sat, 23 Dec 2023 14:44:09 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1672E1DAA76A602A0BEAF22AA6D16179; MSPTC=o9-U92yCzqLlYv5qiqXudTHYI0pNTM5j9bswukn8NBI
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DE0CD6503E7F40F59BCA2B83B92EBFC0 Ref B: LON04EDGE0913 Ref C: 2023-12-23T14:44:10Z
date: Sat, 23 Dec 2023 14:44:09 GMT
-
Remote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTRResponse194.178.17.96.in-addr.arpaIN PTRa96-17-178-194deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestpastebin.comIN AResponsepastebin.comIN A104.20.67.143pastebin.comIN A172.67.34.170pastebin.comIN A104.20.68.143
-
Remote address:8.8.8.8:53Requestpastebin.comIN A
-
Remote address:8.8.8.8:53Requestpastebin.comIN A
-
Remote address:8.8.8.8:53Requestpastebin.comIN A
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Requestcutit.orgIN AResponsecutit.orgIN A64.91.240.248
-
Remote address:64.91.240.248:443RequestGET /oxgBR HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
Host: cutit.org
Cache-Control: no-cache
ResponseHTTP/1.1 302 Moved Temporarily
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
X-Powered-By: PHP/5.4.16
Connection: close
Cache-Control: no-cache
Pragma: no-cache
Location: http://ww7.cutit.org/oxgBR?usid=25&utid=4381267261
Content-Length: 0
Content-Type: text/html; charset=UTF-8
-
Remote address:8.8.8.8:53Request143.67.20.104.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request248.240.91.64.in-addr.arpaIN PTRResponse248.240.91.64.in-addr.arpaIN PTRcrocodile parklogiccom
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request32.169.19.2.in-addr.arpaIN PTRResponse32.169.19.2.in-addr.arpaIN PTRa2-19-169-32deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request201.179.17.96.in-addr.arpaIN PTRResponse201.179.17.96.in-addr.arpaIN PTRa96-17-179-201deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestww7.cutit.orgIN AResponseww7.cutit.orgIN CNAME78626.bodis.com78626.bodis.comIN A199.59.243.225
-
Remote address:199.59.243.225:80RequestGET /oxgBR?usid=25&utid=4381267261 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393
Cache-Control: no-cache
Host: ww7.cutit.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
content-type: text/html; charset=utf-8
content-length: 1097
x-request-id: 370707fd-5160-464b-a557-f4460b3f42d8
cache-control: no-store, max-age=0
accept-ch: sec-ch-prefers-color-scheme
critical-ch: sec-ch-prefers-color-scheme
vary: sec-ch-prefers-color-scheme
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_hchMApm7X8ADspzSVVQ86OO7V6lbNlv7BVavRMBxZRj1UxNpk53QQbh48Any7EkjvKA6hChoJwclMW/3pPERuw==
set-cookie: parking_session=370707fd-5160-464b-a557-f4460b3f42d8; expires=Sat, 23 Dec 2023 14:59:26 GMT; path=/
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301550_1KTS2U40XABEYSP4S&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301550_1KTS2U40XABEYSP4S&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 164057
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 25EB4F4C848F4774B79BADA87D49267E Ref B: LON04EDGE0915 Ref C: 2023-12-23T14:44:44Z
date: Sat, 23 Dec 2023 14:44:43 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301282_1QSYIXXV2WWSLPKD1&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301282_1QSYIXXV2WWSLPKD1&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 202644
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1961A025E8CF4B3D92DCD40E6A20229B Ref B: LON04EDGE0915 Ref C: 2023-12-23T14:44:44Z
date: Sat, 23 Dec 2023 14:44:43 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317300960_1ICQ4HC4DA1BI7PLM&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317300960_1ICQ4HC4DA1BI7PLM&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 263962
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: ADB73030487641EAA1FF34F63BA3E38F Ref B: LON04EDGE0915 Ref C: 2023-12-23T14:44:44Z
date: Sat, 23 Dec 2023 14:44:43 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301393_1DLI2GHT6T3VY9S09&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301393_1DLI2GHT6T3VY9S09&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 306539
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E9F30A44412F400B8786101BD4A6E51E Ref B: LON04EDGE0915 Ref C: 2023-12-23T14:44:44Z
date: Sat, 23 Dec 2023 14:44:43 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301141_1T14XQS0S9BBP3SVW&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301141_1T14XQS0S9BBP3SVW&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 184690
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 247CCBCF4BB24AAC8E7AFD7F85CBC24D Ref B: LON04EDGE0915 Ref C: 2023-12-23T14:44:44Z
date: Sat, 23 Dec 2023 14:44:43 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301691_1QJ97KE46ORIIETXS&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301691_1QJ97KE46ORIIETXS&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 133232
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 45047A022CB448BB96B5FD24C3250EE6 Ref B: LON04EDGE0915 Ref C: 2023-12-23T14:44:45Z
date: Sat, 23 Dec 2023 14:44:45 GMT
-
Remote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTRResponse100.5.17.2.in-addr.arpaIN PTRa2-17-5-100deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.178.17.96.in-addr.arpaIN PTRResponse209.178.17.96.in-addr.arpaIN PTRa96-17-178-209deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request22.236.111.52.in-addr.arpaIN PTR
-
Remote address:96.17.178.176:80Response�j=���:Q@R���=Ю�k�����] �Y��0:�+Q�����#X6�������:,a�\OD_H'�z�p2z����f^������<�����n�g�h�d�3,O��$���t`f�GrDF�3������w�; $Ȯtְ0�Zrg�p}��xQ�ۚ=���p]Ga!� '�R:�3������G��:���o�BN��M��h��ku���#��#b��wj�<7rr|d����Y�`Y��, �C��j<M-���&C�����O��HM�\\��V) -�8��XMFز$5�%?�@�g!���� `�3�� ��Y���m�Z8�����5(_E�g/g2��=��%[J�2�3����;1~��<�� ��y _�˹�+�� @�,?����q�߃����FOD�����l7/�M�@����'���=n����J�5"��2� �H�OYHhg�0��w���u6�ܝ�qk⍨G��D��[�/��TPdI�W���]�P-+�f�,إC���|�+=�U�J��Б:Z���!�� Kb���������7�E��gq������O�ڥ��}��s��a����êE-�C����1�O�i�>�e��u�5���D.zE��`�4�J��{�3V�ѣ�4���xgR����x��}���k���c�A���?w3?�,�R��l_����]T?i6�?����OD?!��h��I��X�4��X<��!8�0u�+�w?��y�W����rH����QvK)̆��{Q�[PQhYRg.t[�Q(X؛+�|�g����D��g�J��<C�н��*+������������ؿ��'�~@�s(f=B_���F� �c��+�aQ��7s���50��� ��!l��.+���0ҼxkWA�i|�!WUUa��|���&K%ik8F����ka���+!��jݚ��!�V��x%c�B�!�8fp�܀\�lE��.%t)sgs��RT]@6�ѫ�A�"�<{�9��?���֜�ɽ�i����ټ5`Dr&�Ce?���e�#�[/����ӂ� �p����^(!n�BSx�N��j��8���3c�!�Ԉ��f��j*�S�nw��/˄ԫ�A���a�>�����dԩ �[r3�u�W�`�;ݟ��p�b�`���9Q����۵�O[���#=��p�u��%]a�~H��tAG��Q�\��"��|Y�XXDtb�n2KF�]����yd�45G^fj�1ey�fl�S2��=���@+3��z���s�M���fN�e)M#��8���: �HBB8 ��#�|z�x(p'�q�R�/�Z����h?~pm�eKwkaN���`(N�/p]����v�-�C�����U�D�Ҳ.T��E+�K��'s2���kxi�Y:�w�i�H�{pU`A������W���u�ٜ5�a�ӽ���x^����_?#�G^������ʅ����)Ac[�����t���@o�P�նdz�ՠ���ʗ糿D!+'�l)�#���4����d���{�T$z���� �M{���?#�/�֡��ܿ�����k�Xj ���?Yl�J /�o��� r��DuY�V��u �m̱T,���?bT���ü^���x���<��w3�Nv[җ4�,wL���6�Qm�v���Ӡ��bh?�4���P�ѥ
��Q��牢���F ��TN6R�MĊ�fb/[��V*G����m�A�N�)�Q�H�� ��� j)`6���oR�ޢ 0�����Hu�rt�QK�<Uf�ʶG~�8q^��0������^��F�6�KƷ���!��WN�R�1��I���z�&��_Mnp�GX`�7@�1Ðmu��瘶�m*�?���D}d���)Z�R_��7Y���zJ�Xރ�U<��?璯�qO��q/�u�������_����~���m.�:yϻ�����<~ݥ�4�y=��������Cy�^'�����)]�.�#]����U.��hg��r�W��Oq�Os�g���r�Or�kx\��:��\�x�K��Ҿ�%��%�K~�K���2�� �x�K�5.�J��z���%��%^��Z��^���]�\��hw��g���\�� W�8�+y<���x<�dzx�3���W���w�?��=x� ��������<ޕ�sy��W�ԯ�q��k���#<�fןK��A���c��#E����<����Xgy�b��o���v}�x�]^����㡃��� v֗�ǻ�x�G��~�k����x�c������� q�?]��x��YC��q���!����q�����u~s��\Ƿ�|�:?��o?�dz��h�:�����s��M��m~Kz�E�x~sܒ�Wؒ��=U[hq����X�f{ ���#��z피f����Z���s<�%>�9n�������s^�Ş^d���M3�uBܞKS����P���z�� =b�3�b���H�xp�X�hқ����#D�'0�D�%��e���w��� �8����şOuPi>�����I�P�.0�z>�!�f�T�vJ��7�_3k�K��ڛi,sLz�T{2����,�h-y9�iEZ�N�ӐZ�Z��"�C+H/"�����Յ �%4:�TmQ�E�c4�3�9���"� ��|C{����c�<����N���ݜ/��*�g�A��BS�6G_�7X�Z����\�mDq-תH��I�c4�iKi�N�4�-Ef�`&M��i�32���������������=�4�C��|�0��BӢ$���|��Nv*�)������)յ\�vv������ݬ�[�&��c�`h��,y�9���ʩ(f��=_k��Y�s(��Ƿl�&�u���x�N�ݒk���e�7�g��ݕN�c�v�6�O���w !�K��(}a�9�� �r$�#1_[X��m)#o�O0��sxE���C3���9�������w�M���+S�/�v5Z��0��XT��}��&x��7T\��9.�X�L,3v+D8�8����AME�Pf!?�E#A�ݮ~!�����\;�����x��A,�9ݙ���5}t~aB>l�~<}�Y�w�ߣ�ܯ�/һ���n�+$7�y�|e<��k��b����*�#�Q���h����Yr�6��ZKj��L��q���kmU�:�����!"Vr���>X�i.�i��}Z�;�t�U+8����ı���P~?�c��\� ��9���r\�q=��Ʊ�c�=�+O���q�=�E���u���?�5�q����帑ce/��%}x���>� ������M�8/ϱ�/�Ϲ��^�?YĵWpl�8�c���vmӺ]�y��� ޮ��[�K�ֺ�4�����p\��������k~�2��s�ӹ���k�4����&�V�W�=�]��q�~����\7��^�>����y}�'�^����%r=�������������5��'�vFq�9.�ܟ�!��G5ʹ?i�Z�G����7����X��9���%+�����og��6�l���㩂���]��H��R<��/��������*W�������]���q�*�|�V^��x��[��8�{��Ǎ��{z���k�����۸=�s�۶�k|��9�K6��mr�O��6���Y?u���Yyl���|��<�,���6����[��?�����v�����YnG��s~+8��s���Ƽ���)86���䶯s�o8��l��������ᜟ�l��Faw;�Y��� ��u���� �隰?��Z��C�5�(C��(����x��M��@i~tuA����0ڑ' �-HӢ����ҋ����7 �g ��h�v8�i.�Jꅶ�q�闂����X˵��d��w����i�+cㅾ�7��@�,p� /���9������/�c��Fv���l׀��S�?��V��K�P�|�K\�J�=z��9���k�}�����d[���?X��}%|AF'�cz֯ߙ��"Ӎ�����p���5�Bx�>��%G��� zXS��ӽ�զWK�R��| ��'�zi�4^|�ŵ_�|�����ci�Ǘ����૮��~�N�3�g��\�FRE�Ĩ����eq�����_�Lޙ�(�Ը�c�]�9uMK<E��:��h����S@k�f;�ﵟ*�_%�yI��4�PoQZ�Fe��0�.�p�K�1�f�����U��B�SQ�(a����e�Q�d�"z�����W: �N �awa�Y�kp����).ޟ�ɢ5o%_J�vtˋ�So����$�`J9�!���#��[�T�����.c?-��-~f���+O�<8��n��z����_���}�h���5n}��/'͓V�9y�*z�kܵ�ρ��.?�8��Ӆ����3�U�^[w(1��B���1��0/�I$%�U̓~_������J�|=z����|I�}Մ�O?Q��Ԃ_�2w�.�2<y�+?W}���y1_������s]q ����hk=J7ޣ�$�X�f 7�Fk��&��Dc�!�,�`N�H�,ļ-�o��ş�7F�0���*�{<��x���I��9dz�~��9��+��;��7��y�����N�p��aW�e�9wŜ��O=+���҉7f�}`�G�d<\�讐o������]���\�+��|��&�w���� �~���>����kܵ�k{�����\�{��mq�_���MvF�3�ZC�T�� �l66/e���T����*|������FK���8�n�}he����������9���cZ^�>]?Uo�r�q�����.Z;ɺ�����5ɡ�U#'�檾t���RW?x����Mzp��#���b����;���I��/�W�f�����t�������k���2����]���]���#qE����雖M�ļ._�\g������#?��֟;V���Cp\����E�c��z;?�?�[�ٺ��\�H�U�qߣ��c����� @�D +N�8����L��qɣ`;*�G�y�<R={�d��-I�Oi���c��UV3NBώ��!�Υ,�����M����r����L�г�m�K��Ko�O�ڶ��=ձ}ez��ס�����n�C~]�Ѿ��[���%��m����7�%?t[2�yڟ�q�����HC�䗌��6����ȑֆ5��öF�Tz��M9(G퐟�R�x����2�n�<�?�KnѮ���z�m���g�����Й*SB��)�T;�k2[��� T9ԥ77�%Ғ�H[��0O�����/��t���[C{pp��<
--6311D6B0A39E5CA4
Content-Type: application/octet-stream
Content-Range: bytes 16875520-16908287/20955201
-
Remote address:8.8.8.8:53Request211.178.17.96.in-addr.arpaIN PTRResponse211.178.17.96.in-addr.arpaIN PTRa96-17-178-211deploystaticakamaitechnologiescom
-
Remote address:96.17.178.211:80ResponseHTTP/1.1 206 Partial Content
Accept-Ranges: bytes
X-AspNetMvc-Version: 5.2
MS-CorrelationId: fdb419ca-bb82-438e-ac59-481089ab18ea
MS-RequestId: c62b8885-3dce-4fdb-943e-42b014d3b60e
MS-CV: FuDIkvp/PUOqVolL.0
Content-Disposition: attachment; filename=Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x86__8wekyb3d8bbwe.Msix
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
X-Azure-Ref-OriginShield: Ref A: 3931C840F9EC47CB98FBAA82F91BFB34 Ref B: CH1AA2040903034 Ref C: 2023-03-15T18:24:30Z
X-MSEdge-Ref: Ref A: CF19AD083D9340C49C57567DEB7E80E2 Ref B: BY3EDGE0405 Ref C: 2023-03-15T18:24:31Z
Last-Modified: Wed, 15 Mar 2023 18:19:22 GMT
ETag: "xVFKVu+y70Rbxkk0UrUZvkwvZDg="
Date: Sat, 23 Dec 2023 14:45:47 GMT
Content-Type: multipart/byteranges; boundary=299EFCA8F0DF3779
Connection: close
X-CID: 2
X-CCC: GB
-
Remote address:96.17.178.211:80ResponseHTTP/1.1 206 Partial Content
Accept-Ranges: bytes
X-AspNetMvc-Version: 5.2
MS-CorrelationId: fdb419ca-bb82-438e-ac59-481089ab18ea
MS-RequestId: c62b8885-3dce-4fdb-943e-42b014d3b60e
MS-CV: FuDIkvp/PUOqVolL.0
Content-Disposition: attachment; filename=Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x86__8wekyb3d8bbwe.Msix
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
X-Azure-Ref-OriginShield: Ref A: 3931C840F9EC47CB98FBAA82F91BFB34 Ref B: CH1AA2040903034 Ref C: 2023-03-15T18:24:30Z
X-MSEdge-Ref: Ref A: CF19AD083D9340C49C57567DEB7E80E2 Ref B: BY3EDGE0405 Ref C: 2023-03-15T18:24:31Z
Last-Modified: Wed, 15 Mar 2023 18:19:22 GMT
ETag: "xVFKVu+y70Rbxkk0UrUZvkwvZDg="
Date: Sat, 23 Dec 2023 14:45:49 GMT
Content-Type: multipart/byteranges; boundary=299EFCA8F0DF3779
Connection: close
X-CID: 2
X-CCC: GB
-
Remote address:8.8.8.8:53Request32.134.221.88.in-addr.arpaIN PTRResponse32.134.221.88.in-addr.arpaIN PTRa88-221-134-32deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request32.134.221.88.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request174.178.17.96.in-addr.arpaIN PTRResponse174.178.17.96.in-addr.arpaIN PTRa96-17-178-174deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request10.173.189.20.in-addr.arpaIN PTRResponse
-
156 B 3
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=tls, http22.0kB 9.4kB 22 18
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=1dd9d62d3dc04bde9291fd2d00c92922&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=HTTP Response
204 -
190 B 92 B 4 2
-
1.2kB 3.9kB 15 10
HTTP Request
GET https://cutit.org/oxgBRHTTP Response
302 -
199.59.243.225:80http://ww7.cutit.org/oxgBR?usid=25&utid=4381267261http895c802177abbd362b58479798f1111c.exe1.0kB 2.6kB 16 6
HTTP Request
GET http://ww7.cutit.org/oxgBR?usid=25&utid=4381267261HTTP Response
200 -
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301691_1QJ97KE46ORIIETXS&pid=21.2&w=1080&h=1920&c=4tls, http247.8kB 1.3MB 965 963
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301550_1KTS2U40XABEYSP4S&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301282_1QSYIXXV2WWSLPKD1&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317300960_1ICQ4HC4DA1BI7PLM&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301393_1DLI2GHT6T3VY9S09&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301141_1T14XQS0S9BBP3SVW&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301691_1QJ97KE46ORIIETXS&pid=21.2&w=1080&h=1920&c=4HTTP Response
200 -
1.2kB 8.3kB 16 14
-
1.1kB 8.2kB 14 12
-
1.2kB 8.3kB 16 14
-
52 B 1
-
52 B 1
-
9.8kB 219.2kB 145 157
-
3.8kB 97.0kB 70 72
-
5.4kB 100.1kB 74 74
-
52 B 1.4kB 1 1
-
46 B 40 B 1 1
-
3.5kB 202.8kB 76 149
HTTP Response
$Ȯtְ0�Zrg�p}��xQ�ۚ=���p]Ga!� '�R:�3������G��:���o�BN��M��h��ku���#��#b��wj�<7rr|d����Y�`Y��, �C��j<M-���&C�����O��HM�\\��V) -�8��XMFز$5�%?�@�g!���� `�3�� ��Y���m�Z8�����5(_E�g/g2��=��%[J�2�3����;1~��<�� -
40 B 1
-
156 B 3
-
3.8kB 230.5kB 82 166
HTTP Response
206 -
6.7kB 223.7kB 130 163
HTTP Response
206 -
46 B 40 B 1 1
-
18.4kB 612.9kB 319 441
-
40 B 1
-
456 B 10.8kB 9 9
-
6.9kB 202.6kB 127 146
-
52 B 1
-
92 B 40 B 2 1
-
92 B 40 B 2 1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
71 B 157 B 1 1
DNS Request
19.53.126.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.136.104.51.in-addr.arpa
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
72 B 137 B 1 1
DNS Request
194.178.17.96.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
232 B 106 B 4 1
DNS Request
pastebin.com
DNS Request
pastebin.com
DNS Request
pastebin.com
DNS Request
pastebin.com
DNS Response
104.20.67.143172.67.34.170104.20.68.143
-
140 B 144 B 2 1
DNS Request
86.23.85.13.in-addr.arpa
DNS Request
86.23.85.13.in-addr.arpa
-
55 B 71 B 1 1
DNS Request
cutit.org
DNS Response
64.91.240.248
-
72 B 134 B 1 1
DNS Request
143.67.20.104.in-addr.arpa
-
72 B 109 B 1 1
DNS Request
248.240.91.64.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
32.169.19.2.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
201.179.17.96.in-addr.arpa
-
59 B 104 B 1 1
DNS Request
ww7.cutit.org
DNS Response
199.59.243.225
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
62 B 173 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
69 B 131 B 1 1
DNS Request
100.5.17.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
119.110.54.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
209.178.17.96.in-addr.arpa
-
72 B 1
DNS Request
22.236.111.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
211.178.17.96.in-addr.arpa
-
144 B 137 B 2 1
DNS Request
32.134.221.88.in-addr.arpa
DNS Request
32.134.221.88.in-addr.arpa
-
-
-
-
-
-
-
-
-
-
-
-
-
72 B 137 B 1 1
DNS Request
174.178.17.96.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
10.173.189.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5d3804dc0c30ea751602e1b7a16963769
SHA12b929ba1177bb7e873ec0bdb02161267b29041fe
SHA25628def381ba4fc1ac7de5afd6b3ab4928407497eb9bf399c060544f4c5de9d783
SHA512eb12fb1d4e2fb2ca6b9881eb936098fdc820283ddcbdc20eaa0c3c3e5c0f106724a432ba9932f426b17621449a1fa98e6bf6c1b2690fe9976e77e878f57173fc
-
Filesize
1KB
MD587fea99532ab781cab3f3cb68dc1b7f0
SHA1b3f37794f7a833a0aa415ffdfef1b252c1947860
SHA2567ba1ba4f4c5c2018b8b31a5da106721a1cbb5e758980d55e469f51aa7e5d7777
SHA512f2b23c033f1b7104898d60cbdf3889062ef8392e3ad7ddf9fb2cab9746b3d6397c17c1e2d4a06082ff55cc0700be10dfc70d8ebb6c2c60cac701ca2bdb767021